CVE-2026-44988: LibVNCClient Tight Gradient decoding allows malicious server-triggered heap/stack OOB writes

Synopsis

A heap and stack out-of-bounds write vulnerability exists in LibVNCClient version 0.9.15 and earlier, affecting the Tight encoding decoder's Gradient filter. The flaw is reachable over the network and requires no authentication, but the connecting VNC client must initiate a session with a malicious VNC server, making victim interaction a prerequisite. Successful exploitation gives the attacker the ability to read sensitive memory, corrupt heap or stack data, and execute arbitrary code in the client process. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix version is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker operates a reachable VNC server on the network; the vulnerable client must connect to it over the network for the malicious FramebufferUpdate to be delivered.

• AuthenticationNot required

  No authentication or account credentials are needed; any connecting client that speaks the Tight encoding protocol is exposed when it contacts a malicious server.

• Victim interactionRequired

  A user or automated process must initiate a VNC client session to the attacker-controlled server, making social engineering or malicious redirection a necessary step.

• Attack complexityDetail

  Exploitation is reliable and condition-free once the client connects; no race conditions, memory-layout guessing, or special environmental factors are required to trigger the out-of-bounds write.

Blast Radius

• Reads arbitrary memory from the VNC client process, exposing session credentials, clipboard contents, or other in-memory data.
• Overwrites heap and stack memory beyond the fixed 2048-pixel Gradient buffers, corrupting client-side data structures.
• Enables execution of attacker-controlled code within the client process at the privilege level of the connecting user.
• Crashes the VNC client process if code execution is not achieved, disrupting any remote-desktop session or automated workflow relying on LibVNCClient.