In QEMU's VNC server implementation (ui/vnc.c), the vnc_refresh_lossy_rect() function contains an out-of-bounds write vulnerability when marking dirty bitmap rows during lossy tile
refresh. The function unconditionally marks a full VNC_STAT_RECT (64) rows of the dirty bitmap for each tile. When the display height is not a multiple of 64 pixels, the last tile
row is a partial tile and the loop writes past the end of the vs->dirty[VNC_MAX_HEIGHT] array. For example, with a 2160-pixel-high display, the last stat tile starts at y=2112 and
the 64-row loop writes rows 2112–2175, overflowing 16 rows (640 bytes) past the dirty bitmap into subsequent VncState fields. This heap buffer overflow could potentially be exploited
by a malicious VNC client that negotiates a specific display resolution to corrupt QEMU process memory, leading to denial of service or possibly arbitrary code execution. Fixed in
QEMU v11.0.3 and v10.0.12.