CVE-2017-5885: Multiple integer overflows in the (1) vnc_connection_server_message and (2) vnc_color_map_set functions in...

Security readout for executives and security teams

This affects software using gtk-vnc to connect to VNC servers. A malicious or compromised VNC server could crash the client and may be able to run code in the client process. The public record names gtk-vnc before 0.7.0; no active exploitation is cited. Exposure is likely limited to desktops, management systems, or applications that include gtk-vnc before 0.7.0 and connect to VNC servers. Risk is higher where users connect to untrusted, internet-hosted, or third-party VNC endpoints. Prioritize remediation where VNC clients are used for administration or connect outside trusted infrastructure. Business impact is mainly client compromise risk and operational disruption, but public evidence is incomplete and no active exploitation is cited. Mitigation focus: Upgrade gtk-vnc to version 0.7.0 or a vendor-fixed package.; Apply relevant Red Hat or Fedora security updates where those distributions are used.; Reduce use of untrusted VNC servers until affected clients are updated..

Prepared

Jun 13, 2026, 06:02 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.