In QEMU's VNC server implementation (ui/vnc.c), the set_pixel_format() function does not properly validate the red_max, green_max, and blue_max fields from a client's
SetPixelFormat message. These fields are received as 16-bit values but are stored internally as uint8_t. A malicious VNC client can send a max value above 255 (e.g., 0x0100) which
passes the existing non-zero validation check but silently truncates to 0 upon assignment, leading to a division by zero in the Tight PNG palette encoding path. This allows a remote
attacker to crash the QEMU process, resulting in a denial of service for all guests served by that QEMU instance. Fixed in QEMU v11.0.3 and v10.0.12.