Neat VNC: Buffer overflow due to oversized RSA public keys
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.
Summary
Neat VNC is a VNC server library. Prior to 0.9.6, a pre-authentication stack buffer overflow exists in neatvnc in the RSA-AES security type handler. An unauthenticated remote attacker who can reach the VNC listening socket can send a crafted security type 5 (RSA-AES) or security type 129 (RSA-AES-256) handshake with an oversized client RSA public key, causing rsa_aes_send_challenge in src/auth/rsa-aes.c to overflow a 1024-byte on-stack buffer when encrypting the server challenge. This results in at least a denial of service via server crash. This vulnerability is fixed in 0.9.6.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA neatvnc (any1) Fixed in 0.9.6
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2026-42859
- 2026-10-25 EPSS moved to the below the 50th percentile
- 2026-10-27 EPSS moved to the 50th–90th percentile
References
More any1 vulnerabilities
- TI-2024-28426 server.c in Neat VNC (aka neatvnc) before 0.8.1 does not properly validate the security… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-42859 · CVE Program
- CVE-2026-42859 · NVD
- FIRST EPSS
- CVE-2026-42859 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences