CVE-2026-32854: 
NixOS vulnerability analysis and mitigation

CVE-2026-32854 is a NULL pointer dereference vulnerability in LibVNCServer's HTTP proxy handlers that allows unauthenticated remote attackers to crash the VNC server process via denial of service. It affects LibVNCServer versions 0.9.15 and prior, and was disclosed on March 24, 2026, with a fix available in commit dc78dee. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The vulnerability (CWE-476: NULL Pointer Dereference) exists in two code paths within httpProcessInput() in src/libvncserver/httpd.c. In Issue A (CONNECT handler, line 359), strchr(buf, ':') is called to locate a colon in the request; if absent, it returns NULL, which is then incremented by 1 and passed directly to atoi(), causing a segmentation fault. In Issue B (GET proxy handler, line 372), strchr(buf, '/') is called without a NULL check, and its return value is passed directly to strncmp() when no slash is present, also causing a segmentation fault. Both vulnerabilities are only reachable when the server is started with the non-default -httpd and -enablehttpproxy flags. The fix in commit dc78dee adds NULL checks for both strchr() return values before use (GitHub Advisory, Patch Commit).

Successful exploitation results in a denial of service — an unauthenticated, network-reachable attacker can crash the VNC server process (SIGSEGV) by sending a single malformed HTTP request to the HTTP port (default TCP 5800). There is no impact on confidentiality or integrity; the vulnerability is limited to availability of the affected VNC server instance. An attacker can repeatedly trigger the crash to maintain a persistent denial of service against affected deployments (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of simple netcat commands with specific malformed payloads. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.0137 (1.37%), indicating low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify VNC servers running LibVNCServer version 0.9.15 or earlier with the HTTP daemon enabled. Scan for open TCP port 5800 (default HTTP port, which is VNC port minus 100) using tools like nmap or masscan.
2. Verify proxy feature: Confirm the target server is running with both -httpd and -enablehttpproxy flags by attempting a standard HTTP connection to port 5800 and observing the response.
3. Trigger Issue A (CONNECT handler crash): Send a malformed CONNECT request lacking a colon character to the HTTP port:

   echo -e "CONNECT nocolon\r\n\r\n" | nc <server_ip> 5800

   This causes strchr(buf, ':') to return NULL, which is then passed as NULL+1 to atoi(), triggering a SIGSEGV.
4. Trigger Issue B (GET proxy handler crash): Alternatively, send a malformed GET request lacking a slash character:

   echo -e "GET noslash\r\n\r\n" | nc <server_ip> 5800

   This causes strchr(buf, '/') to return NULL, which is passed directly to strncmp(), triggering a SIGSEGV.
5. Achieve denial of service: The VNC server process crashes immediately upon receiving either payload. Repeat as needed to maintain persistent denial of service (GitHub Advisory).

• Network: Unexpected or malformed HTTP requests to TCP port 5800 (or other configured HTTP port) containing CONNECT requests without a colon, or GET requests without a slash in the request line; single-packet connections from external IPs to the VNC HTTP port.
• Logs: VNC server logs showing httpd: CONNECT format invalid. error messages or abrupt process termination entries; system logs (e.g., syslog, journald) recording SIGSEGV or segmentation fault for the VNC server process.
• Process: Unexpected termination or restart of the LibVNCServer process; crash dump files (core dumps) generated by the VNC server process in the working directory.

Upgrade LibVNCServer to a version that includes commit dc78dee51a7e270e537a541a17befdf2073f5314, which adds NULL checks for strchr() return values in both vulnerable code paths. If immediate patching is not possible, disable the -httpd and -enablehttpproxy server options, as both must be explicitly enabled for the vulnerability to be reachable (both are non-default). Additionally, implement network-level filtering (firewall rules) to restrict access to TCP port 5800 to trusted sources only (GitHub Advisory, Patch Commit).

Red Hat tracked the vulnerability via Bugzilla (Bug 2450845) and assigned it medium severity. The openSUSE project issued security announcements and included the fix in Tumbleweed monthly updates. The vulnerability received coverage in German Linux security news (pro-linux.de) and was noted in the Solus Linux weekly update. No significant researcher commentary or broader media coverage beyond standard vulnerability tracking has been observed (Red Hat Bugzilla).