CVE-2026-32854

HighPublic PoC

Published: 24 March 2026

Published

24 March 2026

Modified

25 March 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score 0.0273 86.1th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-32854 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Libvncserver Project Libvncserver. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 13.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-11 (Error Handling).

Threat & Defense at a Glance

What attackers do: exploitation maps to Application or System Exploitation (T1499.004). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly addresses the vulnerability by requiring timely remediation of the specific null pointer dereference flaw in LibVNCServer through patching to the fixed commit.

SI-10 Information Input Validation good match

prevent

Mandates validation of HTTP request inputs in the proxy handlers to prevent specially crafted requests from triggering the unvalidated strchr() return value leading to null pointer dereference.

SI-11 Error Handling good match

prevent

Ensures proper error handling for missing strchr() validations in HTTP proxy paths to avoid crashes from null pointer dereferences instead of failing gracefully.

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

Null pointer dereference in HTTP proxy handler allows remote unauthenticated crafted requests to crash the LibVNCServer process, directly mapping to application/system exploitation for endpoint denial of service.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers…

can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled.

Deeper analysisAI

CVE-2026-32854 is a null pointer dereference vulnerability (CWE-476) in LibVNCServer versions 0.9.15 and prior. The flaw exists in the HTTP proxy handlers within the httpProcessInput() function in httpd.c, stemming from missing validation of strchr() return values in the CONNECT and GET proxy handling paths. This allows remote attackers to trigger null pointer dereferences by sending specially crafted HTTP requests, leading to server crashes when httpd and proxy features are enabled. The issue was fixed in commit dc78dee51a7e270e537a541a17befdf2073f5314.

Remote, unauthenticated attackers with network access can exploit this vulnerability with low complexity and no user interaction, as reflected in its CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Successful exploitation causes a denial of service by crashing the affected LibVNCServer instance, disrupting VNC services that rely on the httpd and proxy components.

Mitigation involves updating to LibVNCServer versions incorporating the fix from commit dc78dee51a7e270e537a541a17befdf2073f5314. Further details on the vulnerability and remediation are provided in the GitHub Security Advisory at GHSA-xjp8-4qqv-5x4x and the VulnCheck advisory at vulncheck.com/advisories/libvncserver-httpd-proxy-null-pointer-dereference.