CVE-2023-3354

Summary

CVE-2023-3354 is a vulnerability affecting the QEMU built-in VNC server. The issue arises when a client connects to the server, triggering a check on the maximum number of connections. If a previous connection is in the handshake phase and fails during cleanup, a NULL pointer dereference occurs. This flaw enables a remote, unauthenticated client to initiate a denial-of-service attack by manipulating the VNC server's connection process.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.