CVE-2020-14400 describes an issue in LibVNCServer before version 0.9.13, where byte-aligned data is accessed via uint16_t pointers in libvncserver/translate.c, affecting products from Canonical, Debian, LibVNCServer Project, and OpenSUSE. This vulnerability is rated High severity (CVSS 7.5), indicating a network-exploitable attack with low complexity and potential for high availability impact, though third parties do not consider it a true vulnerability due to the lack of a known exploitation path or trust boundary crossing. There is no evidence of active exploitation, no public exploit code (Metasploit, Nuclei, ExploitDB), and minimal community discussion or media coverage, suggesting a low immediate threat.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 0.9.13CPE matchmatch criteria | cpe:2.3:a:libvncserver_project:libvncserver:*:*:*:*:*:*:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | ||
15.1CPE matchmatch criteria | cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | ||
15.2CPE matchmatch criteria | cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.