Tight JPEG decoding in TightVNC and UltraVNC viewers contains a heap-based buffer overflow because an attacker-controlled framebuffer rectangle width is not validated against a fixed-size decoding buffer. A malicious VNC server can cause an out-of-bounds heap write when a user connects, resulting in application crash and potentially other memory-corruption impacts.

Tight JPEG decoding in TightVNC and UltraVNC viewers contains a heap-based buffer overflow because an attacker-controlled framebuffer rectangle width is not validated against a fixed-size decoding buffer. A malicious VNC server can cause an out-of-bounds heap write when a user connects, resulting in application crash and potentially other memory-corruption impacts.

Affected: Ubuntu:Pro:14.04:LTS: tightvnc, Ubuntu:16.04:LTS: tightvnc, Ubuntu:18.04:LTS: tightvnc, Ubuntu:20.04:LTS: tightvnc, Ubuntu:22.04:LTS: tightvnc, Ubuntu:24.04:LTS: tightvnc, Ubuntu:26.10: tightvnc, Ubuntu:26.04:LTS: tightvnc

Tight JPEG decoding in TightVNC and UltraVNC viewers contains a heap-based buffer overflow because an attacker-controlled framebuffer rectangle width is not validated against a fixed-size decoding buffer. A malicious VNC server can cause an out-of-bounds heap write when a user connects, resulting in application crash and potentially other memory-corruption impacts.

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in UltraVNC ausnutzen, um einen Denial-of-Service-Angriff durchzuführen oder beliebigen Programmcode auszuführen.