CVE-2020-14399

HIGH 7.5CVE-2020-14399 · Published 17/06/2020 · updated 17/06/2026

In short

CVE-2020-14399 is a HIGH (CVSS 7.5) vulnerability affecting libvncserver (libvncserver project).
Chance of exploitation in the next 30 days (EPSS): 2.8%, higher than 86.5% of all vulnerabilities.
Fix: update to 0.9.13 or later.

Package	Affected versions	Patched versions
libvncserver libvncserver_project	`< 0.9.13`	`0.9.13`

Description

An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. NOTE: there is reportedly "no trust boundary crossed.

References

lists.opensuse.org/opensuse-security-announce/2020-07/msg00033.html · Mailing List
lists.opensuse.org/opensuse-security-announce/2020-07/msg00055.html · Mailing List
lists.opensuse.org/opensuse-security-announce/2020-07/msg00066.html · Mailing List
bugzilla.redhat.com/show_bug.cgi · Issue Tracking
LibVNC/libvncserver commit 23e5cbe · Patch
LibVNC/libvncserver · Release Notes
lists.debian.org/debian-lts-announce/2020/06/msg00035.html · Mailing List
lists.debian.org/debian-lts-announce/2020/08/msg00045.html · Mailing List
usn.ubuntu.com/4434-1 · Third Party Advisory

More vulnerabilities in libvncserver

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

libvncserver

libvncserver_project

< 0.9.13

0.9.13

More vulnerabilities in libvncserver

See all →