TurboVNC server code contains stack buffer overflow vulnerability in commit prior to cea98166008301e614e0d36776bf9435a536136e.

published 2019-10-29 7y ago modified 2026-06-17 4mo ago also EUVD-2019-6622

cvss: 9.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 19.4%; EPSS 19.4% chance of exploitation in 30 days, percentile 97%
public exploits: 0; none known

TurboVNC server code contains stack buffer overflow vulnerability in commit prior to cea98166008301e614e0d36776bf9435a536136e. This could possibly result into remote code execution, since stack frame is not protected with stack canary. This attack appear to be exploitable via network connectivity. To exploit this vulnerability authorization on server is required. These issues have been fixed in commit cea98166008301e614e0d36776bf9435a536136e.

Patch / fix

fixed in 1 links 1

turbovnc turbovnc 2.2.3

github.com/TurboVNC/turbovnc@cea9816 commit

Is CVE-2019-15683 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

19.39% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

Kaspersky TurboVNC

Classification

Weakness

CWE-121 Stack-based Buffer Overflow
CWE-787 Out-of-bounds Write

References

github.com /TurboVNC/turbovnc/commit/cea98166008301e614e0d36776bf9435a536136e
patch, third-party-advisory

Sources

CVE List CVE-2019-15683
NVD CVE-2019-15683

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.