Skip to main content
Version: Developer

KasmVNC 1.6.0

Features​

  • Added real-time connection and performance statistics. Server resource usage (CPU, memory, disk I/O), transport-layer metrics (RTT, jitter, bandwidth), and end-to-end input-to-screen latency are now available via the /api/system/stats endpoint and as postMessage events when KasmVNC is embedded in a Kasm VDI iframe, enabling host applications to monitor and respond to session quality in real time.

  • Reduced the number of browser resources requested when KasmVNC is embedded in Kasm Workspaces, lowering proxy authentication and session lookup overhead during client startup.

  • Increased the maximum frame rate from 60 to 120 FPS.

  • Added native multi-touch input and selectable gesture emulation, controlled by the new pointer.touch_support setting (-AllowTouchSupport). Added optional automatic on-screen keyboard activation for supported text fields on touch devices, with manual keyboard controls available when detection or browser activation is unavailable.

Bug Fixes​

  • Fixed a potential buffer overflow that could occur while parsing the WebSocket handshake request.
  • Fixed /api/get_sessions continuing to report a user after the final client disconnected.
  • Fixed a potential buffer overflow that could occur while parsing SCTP heartbeat data.
  • Fixed a segmentation fault when the watermark location exceeded the screen resolution.
  • Fixed a potential vulnerability in the connection statistics display rendering in the client.
  • Fixed a potential out-of-bounds memory copy that could occur while parsing the WebSocket handshake request.
  • Fixed a potential buffer overflow that could occur while parsing JSON with usernames.
  • Fixed a potential out-of-memory crash in the client that could occur while decompressing compromised data.
  • Fixed a potential out-of-bounds memory read that could occur while converting clipboard text from UTF-8 to Latin-1.
  • Fixed a potential buffer overflow in /api/get_screenshot that could occur when producing a screenshot.
  • Fixed a potential stack buffer overflow that could occur while logging a requested file path with verbose logging enabled.
  • Fixed user password hashes being generated with a fixed salt, which allowed precomputed dictionary attacks against a leaked password file.
  • Fixed a potential buffer overflow that could occur when a client announced duplicate MIME types in a binary clipboard update.
  • Reduced the time it takes to start a KasmVNC session, especially on systems with slower storage.
  • Fixed the input method editor (IME) not working when it was enabled from the start of a session.
  • Fixed an issue where a temporary file was created with excessive access rights.
  • Fixed a vulnerability allowing clients to trigger memory allocation of arbitrary size by supplying an unvalidated length.
  • Fixed a potential buffer overflow that could occur while logging binary clipboard content with verbose DLP logging enabled.