News

We’re happy to announce the release of Veyon 4.11.1. This patch release is a security- and reliability-focused update that hardens the VNC network protocol, the internal feature-communication layer, and the Linux authentication helper against malformed data, tampering, and unauthorized access. It also fixes a broken wildcard pattern matching in access control rules, corrects configuration merge/migration bugs, and adds a new setting to cap simultaneous server connections and protect against resource exhaustion. On Linux, the PipeWire-based VNC server for Wayland sessions has been greatly optimized for much lower CPU usage, while the demo/broadcast feature was refactored to recover more smoothly from slow or disconnected student computers.

Beyond the under-the-hood work, this release brings several user-facing conveniences and bugfixes: teachers can now set a custom title for text messages sent to students, remote access windows show screen content immediately instead of with a delay, and file transfer failures now surface a clear error dialog rather than failing silently. Various crashes and glitches were also resolved, including one when closing a computer’s zoom view, incorrect computer removal in the Spotlight view, and Windows-specific issues around service reinstallation and virtual desktop detection. LDAP/AD searches are more robust against special characters, and the CLI now gives clearer error messages for invalid or unknown commands.

All downloads for this release are available in the download area.

A complete list of changes in detail can be found below:

• Core, security & reliability
  • Hardened the VNC network protocol against malformed or oversized data, improving stability and security when connecting to computers (by @pioug43)
  • Improved authentication security for internal feature communication, protecting against unauthorized message injection (by @pioug43)
  • Significantly hardened the Linux authentication helper (used for logon checks) against memory inspection and environment tampering attacks
  • Linux: environment variables passed to a newly started Veyon Server (e.g. display, session bus, audio settings) are now validated and filtered to prevent injection of unsafe or spoofed values
  • Fixed the “Wildcard” pattern matching used in access control rules (e.g. *.example.org) to behave correctly and safely (by @pioug43)
  • Fixed broken config merge and key removal (#1155)
  • Fixed configuration migration between non-subsequent minor releases
  • Use Qt rather than OpenSSL directly for generating random data
  • Pipewire and headless VNC servers now listen on localhost only like all other internal VNC server backends
  • Updatedand rebased bundled libvncserver library to latest upstream version
• Master
  • Fixed delay in remote access windows to show screen updates immediately after opening the window
  • Fixed a crash that could occur when closing the “zoom” view for a computer (by @pioug43)
  • Fixed an issue where removing computers from the Spotlight view could accidentally remove the wrong computer
• Configurator
  • Fixed location table state and button management (#1150 by @NICourced)
  • Added a new setting, “Maximum simultaneous server connections” to protect the Veyon Server from being overwhelmed by too many connections at once (by @pioug43)
  • Check for a valid access control rule being selected when clicking “Move down”
• Plugins
  • Demo: fixed several issues where a slow or lagging student computer during a demo/broadcast could not (re)connect; the demo feature now recovers more smoothly and adapts image quality more accurately based on actual bandwidth usage
  • FileTransfer: users now see a clear error dialog if a file transfer fails, instead of the failure passing silently.
  • LDAP: Improved special-character handling when searching LDAP/Active Directory, fixing potential search failures with names containing special characters
  • LDAP: added “ou” (organizational unit) as an option for identifying location names
  • PowerControl: fixed missing confirmation dialog handling for delayed power-down
  • RemoteAccess: fixed memory leak
  • RemoteAccess: use lighter image compression resulting in less CPU usage on the clients at the cost of slightly more bandwidth
  • Screenshot: wait for initial framebuffer update when invoked immediately after connecting (e.g. via CLI/WebAPI) (#1067)
  • TextMessage: dialog now lets teachers set a custom title for the message window shown to students and defaults to “Message from " (#999, #1129, #1159 / by @pioug43)
  • TextMessage: always show and keep message dialog in front
  • WebAPI: added null-connection checks across several endpoints
  • WebAPI: fixed HTTPS setup logic
• CLI
  • Refactored handling of invalid or unknown commands and improved messages and fixed crash in certain error cases (#1152)
  • Fixed wrong order of arguments printed in the help for certain commands (#1156)
• Linux
  • Greatly improved performance of the Pipewire-based VNC server for Wayland sessions, resulting in much lower CPU usage
  • Fixed an issue where remote screen-share/demo sessions could occasionally miss part of the screen after resizing
  • Improved reliability of user session detection and reduced console error spam in non-standard environments
• Windows
  • Fixed a possible crash/leak when repeatedly installing or reinstalling the Veyon service
  • Fixed incorrect detection of the active virtual desktop, which could affect window focus behavior on some systems
  • Fixed potential memory issues in the Windows Event Log integration
  • 3rdparty: UltraVNC: include fixes for certain VDI environments
  • 3rdparty: OpenLDAP: update to 2.6.14