VULNERABILITY INTELLIGENCE
CVE-2018-7225
CVSS score9.8 CRITICAL
EPSS probability6.11%
CISA KEVNot currently listed
Published2018-02-19
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
An issue was discovered in LibVNCServer through 0.9.11. rfbProcessClientNormalMessage() in rfbserver.c does not sanitize msg.cct.length, leading to access to uninitialized and potentially sensitive data or possibly unspecified other impact (e.g., an integer overflow) via specially crafted VNC packets.
Weakness classification
- CWE-190: Integer Overflow or Wraparound
Primary references
- cve@mitre.org — Exploit, Mailing List, Third Party Advisory
- cve@mitre.org — Third Party Advisory, VDB Entry
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Mailing List, Third Party Advisory
- cve@mitre.org
- cve@mitre.org
- cve@mitre.org
- cve@mitre.org
- cve@mitre.org — Third Party Advisory
- cve@mitre.org
- cve@mitre.org