Amazon Linux 2 Security Advisory: ALAS2-2026-3247
Advisory Released Date: 2026-04-14
Advisory Updated Date: 2026-04-14
LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP() function by manipulating subrectangle header counts to read beyond the allocated heap buffer. (CVE-2026-32853)
LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled. (CVE-2026-32854)
Affected Packages:
libvncserver
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update libvncserver or yum update --advisory ALAS2-2026-3247 to update your system.
aarch64:
libvncserver-0.9.9-14.amzn2.0.2.aarch64
libvncserver-devel-0.9.9-14.amzn2.0.2.aarch64
libvncserver-debuginfo-0.9.9-14.amzn2.0.2.aarch64
i686:
libvncserver-0.9.9-14.amzn2.0.2.i686
libvncserver-devel-0.9.9-14.amzn2.0.2.i686
libvncserver-debuginfo-0.9.9-14.amzn2.0.2.i686
src:
libvncserver-0.9.9-14.amzn2.0.2.src
x86_64:
libvncserver-0.9.9-14.amzn2.0.2.x86_64
libvncserver-devel-0.9.9-14.amzn2.0.2.x86_64
libvncserver-debuginfo-0.9.9-14.amzn2.0.2.x86_64