A heap out-of-bounds read vulnerability in LibVNCServer versions 0.9.15 and prior poses a significant risk of information disclosure or service disruption through unauthenticated remote exploitation.

The flaw exists in the HandleUltraZipBPP function due to improper bounds checking when processing subrectangle header counts. This vulnerability allows an unauthenticated remote attacker to read beyond the allocated heap buffer by supplying a malicious VNC server response.

The ability for an unauthenticated attacker to trigger an out-of-bounds read can lead to the exposure of sensitive memory contents or cause the VNC service to crash, resulting in denial of service. With a CVSS score of 8.1, this vulnerability represents a high-severity risk to system availability and data confidentiality, particularly for infrastructure relying on VNC for remote administration.

Immediate Action: Update LibVNCServer to the version incorporating the fix found in commit 009008e2f4d5a54dd71f422070df3af7b3dbc931.

Proactive Monitoring: Monitor VNC service logs for frequent application crashes or unexpected service restarts which may indicate exploitation attempts.

Compensating Controls: Restrict VNC access to trusted IP addresses using network firewalls or VPNs to limit the exposure of the service to potentially malicious VNC servers.

Public Exploit Available: No

Given the high CVSS score and the presence of a known proof-of-concept, this vulnerability should be prioritized for patching. Organizations utilizing LibVNCServer must verify their current version and apply the upstream fix immediately to prevent potential information disclosure or service instability.