CVE-2026-42859
Neat VNC: Buffer overflow due to oversized RSA public keys
- State
- Published
- Severity
- 8.1 High
- Published
- May 11, 2026
- Updated
- May 11, 2026
- Reserved
- Apr 30, 2026
Description
Neat VNC is a VNC server library. Prior to 0.9.6, a pre-authentication stack buffer overflow exists in neatvnc in the RSA-AES security type handler. An unauthenticated remote attacker who can reach the VNC listening socket can send a crafted security type 5 (RSA-AES) or security type 129 (RSA-AES-256) handshake with an oversized client RSA public key, causing rsa_aes_send_challenge in src/auth/rsa-aes.c to overflow a 1024-byte on-stack buffer when encrypting the server challenge. This results in at least a denial of service via server crash. This vulnerability is fixed in 0.9.6.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U | GitHub_M |
Weaknesses
- CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected Products
| Product | Versions |
|---|---|
neatvncany1 |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.