CVE-2026-32854: LibVNCServer DoS Vulnerability

CVE-2026-32854 Overview

LibVNCServer versions 0.9.15 and prior contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled.

Critical Impact

Remote attackers can crash LibVNCServer instances by exploiting improper input validation in HTTP proxy handlers, causing denial of service for VNC services.

Affected Products

• LibVNCServer versions 0.9.15 and prior
• Systems with httpd and proxy features enabled
• Applications built using vulnerable LibVNCServer libraries

Discovery Timeline

• 2026-03-24 - CVE-2026-32854 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-32854

Vulnerability Analysis

This vulnerability stems from improper input validation in the HTTP proxy handling functionality of LibVNCServer. The httpProcessInput() function in httpd.c processes incoming HTTP requests when the httpd and proxy features are enabled. The vulnerable code paths handle both CONNECT and GET proxy requests but fail to properly validate return values from string parsing operations.

When processing proxy requests, the code uses strchr() to locate delimiter characters in the input. However, the return value from strchr() is not checked before being dereferenced. If strchr() returns NULL (indicating the delimiter was not found), the subsequent pointer arithmetic and dereference operations result in a null pointer dereference, causing the server process to crash.

This vulnerability is classified as CWE-476 (NULL Pointer Dereference), a memory safety issue that occurs when a program dereferences a pointer that it expects to be valid but is actually NULL.

Root Cause

The root cause is missing validation of strchr() return values in the CONNECT and GET proxy handling paths within httpProcessInput(). The function assumes that input strings will always contain expected delimiters, but attackers can craft malformed HTTP requests that bypass this assumption, causing strchr() to return NULL and triggering a null pointer dereference when the code attempts to use the result.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can remotely send specially crafted HTTP requests to a LibVNCServer instance that has httpd and proxy features enabled. The malformed requests are designed to trigger the code path where strchr() fails to find expected delimiters.

The attack requires the following conditions:

• Target LibVNCServer instance must have httpd functionality enabled
• Proxy features must be active
• Network access to the HTTP service port

When a vulnerable server processes the malicious request, it attempts to parse the HTTP headers or URI but fails to find required delimiter characters. The resulting null pointer from strchr() is then dereferenced, causing an immediate crash and denial of service.

Detection Methods for CVE-2026-32854

Indicators of Compromise

• Unexpected crashes or restarts of VNC server processes
• Core dumps or crash logs showing null pointer dereference in httpd.c or httpProcessInput()
• Malformed HTTP requests in access logs targeting proxy endpoints
• Repeated connection attempts from suspicious IP addresses to VNC HTTP ports

Detection Strategies

• Monitor VNC server process stability for unexpected terminations or crashes
• Implement network intrusion detection rules for malformed HTTP CONNECT and GET requests
• Analyze HTTP access logs for requests with missing or malformed delimiter characters
• Deploy application crash monitoring to detect null pointer dereference exceptions in LibVNCServer

Monitoring Recommendations

• Enable verbose logging for HTTP proxy functionality in LibVNCServer configurations
• Set up process monitoring with automatic alerting for VNC server crashes
• Implement rate limiting on HTTP proxy endpoints to detect potential exploitation attempts
• Review network traffic patterns for anomalous HTTP requests targeting VNC services

How to Mitigate CVE-2026-32854

Immediate Actions Required

• Update LibVNCServer to a version containing commit dc78dee51a7e270e537a541a17befdf2073f5314 or later
• Disable httpd and proxy features if not required for your deployment
• Implement network segmentation to limit exposure of VNC services
• Deploy web application firewall rules to filter malformed HTTP requests

Patch Information

The vulnerability has been fixed in commit dc78dee51a7e270e537a541a17befdf2073f5314. Organizations should update to the latest version of LibVNCServer that includes this fix. The patch adds proper validation of strchr() return values before dereferencing, ensuring that NULL returns are handled safely without causing crashes.

For detailed information about the fix, refer to the GitHub Commit and the GitHub Security Advisory.

Workarounds

• Disable the HTTP proxy functionality by configuring LibVNCServer without httpd support
• Use firewall rules to restrict access to the HTTP service port to trusted networks only
• Deploy a reverse proxy with input validation in front of LibVNCServer HTTP endpoints
• Consider using VNC over SSH tunnels instead of the built-in HTTP proxy functionality

# Configuration example
# Restrict access to VNC HTTP port using iptables
iptables -A INPUT -p tcp --dport 5800 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 5800 -j DROP

# Alternatively, disable HTTP functionality if not required
# Check LibVNCServer build options and rebuild without httpd support