Possible screensharingd RFB pre-auth exploit - length-check bypass frame

Duo Tech@duotech

•updated Aug 17, 2026•0•0•6

Detects the RFB protocol length-field bypass frame pattern used to exploit the screensharingd pre-auth authentication bypass (CVE-2026-65400) on ports 5900/5988.