CVE-2016-5008: Debian Linux

Critical severity, CVSS 9.8. EPSS: 3.7% chance of exploitation in the next 30 days.

libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers to bypass authentication and establish a VNC session by connecting to the server.

Affected products

• Debian Debian Linux: version 8.0 only
• Red Hat Libvirt: up to and including 1.3.5

Published 2016-07-13. Last modified 2026-06-17.