CVE-2017-18922: It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSock...

Security readout for executives and security teams

LibVNCServer before 0.9.12 mishandled certain WebSocket frames. An attacker able to send crafted WebSocket traffic to an affected VNC server could trigger a heap buffer overflow, which may crash the service or create memory-corruption risk. Public sources do not provide CVSS or confirmed exploitation evidence. Exposure is most likely where LibVNCServer, or software embedding it, is reachable and WebSocket VNC functionality is enabled. The bundle does not identify a complete affected product list, so inventory should include direct libraries, distribution packages, and embedded dependencies. Treat this as a high-priority patching item for exposed remote access services. The risk is strongest where VNC over WebSocket is reachable from untrusted networks. Prioritize internet-facing and third-party-accessible environments first. Mitigation focus: Upgrade LibVNCServer to 0.9.12 or a vendor-fixed package.; Apply relevant Ubuntu, Fedora, openSUSE, or other vendor security updates.; Identify applications or appliances embedding vulnerable LibVNCServer versions..

Prepared

Jun 3, 2026, 11:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.