Stack Buffer Overflow in Neat VNC Server Library Affects Multiple Versions

CVE-2026-42859

What is CVE-2026-42859?

A pre-authentication stack buffer overflow vulnerability has been identified in the Neat VNC server library. This vulnerability allows an unauthenticated remote attacker to exploit the VNC listening socket by sending a specially crafted RSA-AES or RSA-AES-256 handshake using an oversized client RSA public key. As a result, this leads to an overflow of a 1024-byte on-stack buffer within the rsa_aes_send_challenge function, potentially causing a denial of service through server crashes. Users are strongly advised to upgrade to version 0.9.6 to mitigate this risk.

References