Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
10 vulnerabilities by GlavSoft
CVE-2026-107615 (GCVE-0-2026-107615)
Vulnerability from nvd – Published: 2026-10-08 13:39 – Updated: 2026-10-08 14:00
VLAI
EPSS
VEX
Title
DLL search order hijacking via screenhooks libraries in TightVNC Server
Summary
An uncontrolled search path element vulnerability in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to execute arbitrary code with SYSTEM privileges. DynamicLibrary::init() (and ThemeLib) load screenhooks32.dll / screenhooks64.dll with LoadLibrary() using a bare file name and no LOAD_LIBRARY_SEARCH_* flags, so the TightVNC service follows the default DLL search order and loads an attacker-planted DLL from a writable directory earlier in that order (for example, an installation directory with permissive ACLs).
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 14:00 UTC
CWE
- CWE-427 - Uncontrolled Search Path Element
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://sourceforge.net/p/vnc-tight/bugs/1666/ | issue-tracking |
| https://www.tightvnc.com/whatsnew.php | release-notespatch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107615",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T14:00:03.531511Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T14:00:27.042Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"TightVNC Server (screen hooks loader)"
],
"platforms": [
"Windows"
],
"product": "TightVNC",
"programFiles": [
"DynamicLibrary.cpp",
"ThemeLib.cpp"
],
"programRoutines": [
{
"name": "DynamicLibrary::init()"
}
],
"vendor": "GlavSoft",
"versions": [
{
"lessThan": "2.8.88",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arjun Basnet from Securin"
}
],
"descriptions": [
{
"lang": "en",
"value": "An uncontrolled search path element vulnerability in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to execute arbitrary code with SYSTEM privileges. DynamicLibrary::init() (and ThemeLib) load screenhooks32.dll / screenhooks64.dll with LoadLibrary() using a bare file name and no LOAD_LIBRARY_SEARCH_* flags, so the TightVNC service follows the default DLL search order and loads an attacker-planted DLL from a writable directory earlier in that order (for example, an installation directory with permissive ACLs)."
}
],
"impacts": [
{
"capecId": "CAPEC-471",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-471 Search Order Hijacking"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427 Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T13:39:59.358Z",
"orgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"shortName": "securin"
},
"references": [
{
"name": "TightVNC bug #1666",
"tags": [
"issue-tracking"
],
"url": "https://sourceforge.net/p/vnc-tight/bugs/1666/"
},
{
"name": "TightVNC release notes (2.8.88)",
"tags": [
"release-notes",
"patch"
],
"url": "https://www.tightvnc.com/whatsnew.php"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade TightVNC for Windows to version 2.8.88 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-05-30T00:00:00.000Z",
"value": "Reported to GlavSoft"
},
{
"lang": "en",
"time": "2026-06-02T00:00:00.000Z",
"value": "Vendor acknowledged"
},
{
"lang": "en",
"time": "2026-06-19T00:00:00.000Z",
"value": "TightVNC 2.8.88 released with fix"
}
],
"title": "DLL search order hijacking via screenhooks libraries in TightVNC Server",
"workarounds": [
{
"lang": "en",
"value": "Ensure the TightVNC installation directory and every directory on the system PATH are writable only by administrators."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"assignerShortName": "securin",
"cveId": "CVE-2026-107615",
"datePublished": "2026-10-08T13:39:59.358Z",
"dateReserved": "2026-10-08T13:23:07.677Z",
"dateUpdated": "2026-10-08T14:00:27.042Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107614 (GCVE-0-2026-107614)
Vulnerability from nvd – Published: 2026-10-08 13:39 – Updated: 2026-10-08 14:01
VLAI
EPSS
VEX
Title
Integer underflow in TightVNC Server cursor shape trimming leads to out-of-bounds read
Summary
An integer underflow in WinCursorShapeUtils::trimTransparent() in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to crash the server, and potentially read out-of-bounds memory, by causing a cursor shape with a width or height of zero to be processed on the DXGI capture path. The loop bound width - 1 wraps to 0xFFFFFFFF, producing an access roughly 4 GB beyond the 64 KB cursor buffer; a monochrome cursor of height 1 also becomes 0 because getCursorHeight() halves the height in place.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 14:00 UTC
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://sourceforge.net/p/vnc-tight/bugs/1661/ | issue-tracking |
| https://www.tightvnc.com/whatsnew.php | release-notespatch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107614",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T14:00:49.369592Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T14:01:01.624Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"TightVNC Server (cursor shape processing)"
],
"platforms": [
"Windows"
],
"product": "TightVNC",
"programFiles": [
"WinCursorShapeUtils.cpp"
],
"programRoutines": [
{
"name": "WinCursorShapeUtils::trimTransparent()"
},
{
"name": "getCursorHeight()"
}
],
"vendor": "GlavSoft",
"versions": [
{
"lessThan": "2.8.88",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arjun Basnet from Securin"
}
],
"descriptions": [
{
"lang": "en",
"value": "An integer underflow in WinCursorShapeUtils::trimTransparent() in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to crash the server, and potentially read out-of-bounds memory, by causing a cursor shape with a width or height of zero to be processed on the DXGI capture path. The loop bound width - 1 wraps to 0xFFFFFFFF, producing an access roughly 4 GB beyond the 64 KB cursor buffer; a monochrome cursor of height 1 also becomes 0 because getCursorHeight() halves the height in place."
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "CWE-191 Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T13:39:58.297Z",
"orgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"shortName": "securin"
},
"references": [
{
"name": "TightVNC bug #1661",
"tags": [
"issue-tracking"
],
"url": "https://sourceforge.net/p/vnc-tight/bugs/1661/"
},
{
"name": "TightVNC release notes (2.8.88)",
"tags": [
"release-notes",
"patch"
],
"url": "https://www.tightvnc.com/whatsnew.php"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade TightVNC for Windows to version 2.8.88 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-05-30T00:00:00.000Z",
"value": "Reported to GlavSoft"
},
{
"lang": "en",
"time": "2026-06-02T00:00:00.000Z",
"value": "Vendor acknowledged"
},
{
"lang": "en",
"time": "2026-06-19T00:00:00.000Z",
"value": "TightVNC 2.8.88 released with fix"
}
],
"title": "Integer underflow in TightVNC Server cursor shape trimming leads to out-of-bounds read"
}
},
"cveMetadata": {
"assignerOrgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"assignerShortName": "securin",
"cveId": "CVE-2026-107614",
"datePublished": "2026-10-08T13:39:58.297Z",
"dateReserved": "2026-10-08T13:23:07.677Z",
"dateUpdated": "2026-10-08T14:01:01.624Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107613 (GCVE-0-2026-107613)
Vulnerability from nvd – Published: 2026-10-08 13:39 – Updated: 2026-10-08 14:01
VLAI
EPSS
VEX
Title
NULL pointer dereference in TightVNC Server Win8ScreenDriver after failed DXGI re-initialization
Summary
A NULL pointer dereference vulnerability in the Win8ScreenDriver component of GlavSoft TightVNC Server for Windows before 2.8.88 allows an attacker to crash the server, causing a denial of service. When re-initialization of the DXGI Desktop Duplication driver fails in applyNewScreenProperties() (for example after a GPU reset, display hot-plug or session change), m_drvImpl is left NULL and is subsequently dereferenced without a check by executeDetection(), getScreenBuffer(), grabFb(), getScreenPropertiesChanged() and getCursorPosition().
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 14:01 UTC
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://sourceforge.net/p/vnc-tight/bugs/1660/ | issue-tracking |
| https://www.tightvnc.com/whatsnew.php | release-notespatch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107613",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T14:01:21.134363Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T14:01:33.803Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"TightVNC Server (Win8/DXGI screen driver)"
],
"platforms": [
"Windows"
],
"product": "TightVNC",
"programFiles": [
"Win8ScreenDriver.cpp"
],
"programRoutines": [
{
"name": "Win8ScreenDriver::applyNewScreenProperties()"
},
{
"name": "Win8ScreenDriver::executeDetection()"
},
{
"name": "Win8ScreenDriver::getScreenBuffer()"
},
{
"name": "Win8ScreenDriver::grabFb()"
},
{
"name": "Win8ScreenDriver::getScreenPropertiesChanged()"
},
{
"name": "Win8ScreenDriver::getCursorPosition()"
}
],
"vendor": "GlavSoft",
"versions": [
{
"lessThan": "2.8.88",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arjun Basnet from Securin"
}
],
"descriptions": [
{
"lang": "en",
"value": "A NULL pointer dereference vulnerability in the Win8ScreenDriver component of GlavSoft TightVNC Server for Windows before 2.8.88 allows an attacker to crash the server, causing a denial of service. When re-initialization of the DXGI Desktop Duplication driver fails in applyNewScreenProperties() (for example after a GPU reset, display hot-plug or session change), m_drvImpl is left NULL and is subsequently dereferenced without a check by executeDetection(), getScreenBuffer(), grabFb(), getScreenPropertiesChanged() and getCursorPosition()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T13:39:56.972Z",
"orgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"shortName": "securin"
},
"references": [
{
"name": "TightVNC bug #1660",
"tags": [
"issue-tracking"
],
"url": "https://sourceforge.net/p/vnc-tight/bugs/1660/"
},
{
"name": "TightVNC release notes (2.8.88)",
"tags": [
"release-notes",
"patch"
],
"url": "https://www.tightvnc.com/whatsnew.php"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade TightVNC for Windows to version 2.8.88 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-05-30T00:00:00.000Z",
"value": "Reported to GlavSoft"
},
{
"lang": "en",
"time": "2026-06-02T00:00:00.000Z",
"value": "Vendor acknowledged"
},
{
"lang": "en",
"time": "2026-06-19T00:00:00.000Z",
"value": "TightVNC 2.8.88 released with fix"
}
],
"title": "NULL pointer dereference in TightVNC Server Win8ScreenDriver after failed DXGI re-initialization"
}
},
"cveMetadata": {
"assignerOrgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"assignerShortName": "securin",
"cveId": "CVE-2026-107613",
"datePublished": "2026-10-08T13:39:56.972Z",
"dateReserved": "2026-10-08T13:23:07.677Z",
"dateUpdated": "2026-10-08T14:01:33.803Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107612 (GCVE-0-2026-107612)
Vulnerability from nvd – Published: 2026-10-08 13:39 – Updated: 2026-10-08 14:02
VLAI
EPSS
VEX
Title
World-accessible IPC shared memory with predictable name in TightVNC Server
Summary
Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communication handles used between the TightVNC service and its desktop server process. The named shared memory segment in the Global\ namespace that carries the pipe HANDLE values is created with a NULL DACL, and its name is derived from a time-seeded srand(time(0)) value that is predictable to one-second granularity. A low-privileged local process can open the mapping and tamper with the IPC channel of a service running as SYSTEM, potentially leading to disclosure of session data, privilege escalation, or denial of service.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 14:01 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://sourceforge.net/p/vnc-tight/bugs/1658/ | issue-tracking |
| https://www.tightvnc.com/whatsnew.php | release-notespatch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107612",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T14:01:50.062814Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T14:02:27.703Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"TightVNC Server (desktop server IPC)"
],
"platforms": [
"Windows"
],
"product": "TightVNC",
"programFiles": [
"SharedMemory.cpp",
"DesktopServerWatcher.cpp"
],
"programRoutines": [
{
"name": "DesktopServerWatcher::execute()"
}
],
"vendor": "GlavSoft",
"versions": [
{
"lessThan": "2.8.88",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arjun Basnet from Securin"
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communication handles used between the TightVNC service and its desktop server process. The named shared memory segment in the Global\\ namespace that carries the pipe HANDLE values is created with a NULL DACL, and its name is derived from a time-seeded srand(time(0)) value that is predictable to one-second granularity. A low-privileged local process can open the mapping and tamper with the IPC channel of a service running as SYSTEM, potentially leading to disclosure of session data, privilege escalation, or denial of service."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-338",
"description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T13:39:55.702Z",
"orgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"shortName": "securin"
},
"references": [
{
"name": "TightVNC bug #1658",
"tags": [
"issue-tracking"
],
"url": "https://sourceforge.net/p/vnc-tight/bugs/1658/"
},
{
"name": "TightVNC release notes (2.8.88)",
"tags": [
"release-notes",
"patch"
],
"url": "https://www.tightvnc.com/whatsnew.php"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade TightVNC for Windows to version 2.8.88 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-05-30T00:00:00.000Z",
"value": "Reported to GlavSoft"
},
{
"lang": "en",
"time": "2026-06-02T00:00:00.000Z",
"value": "Vendor acknowledged"
},
{
"lang": "en",
"time": "2026-06-19T00:00:00.000Z",
"value": "TightVNC 2.8.88 released with fix"
}
],
"title": "World-accessible IPC shared memory with predictable name in TightVNC Server"
}
},
"cveMetadata": {
"assignerOrgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"assignerShortName": "securin",
"cveId": "CVE-2026-107612",
"datePublished": "2026-10-08T13:39:55.702Z",
"dateReserved": "2026-10-08T13:23:07.677Z",
"dateUpdated": "2026-10-08T14:02:27.703Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107611 (GCVE-0-2026-107611)
Vulnerability from nvd – Published: 2026-10-08 13:39 – Updated: 2026-10-08 14:03
VLAI
EPSS
VEX
Title
Out-of-bounds read in TightVNC Viewer ZRLE palette decoding
Summary
An out-of-bounds read vulnerability in the ZRLE decoder of GlavSoft TightVNC Viewer for Windows before 2.8.88 allows a malicious or compromised VNC server to read heap memory beyond the palette allocation and crash the viewer by sending ZRLE-encoded tiles whose palette indices exceed the declared palette size. readPaletteRleTile() and readPackedPaletteTile() use the attacker-supplied index to look up colours without validating it against the palette size; out-of-bounds heap data is copied into the framebuffer (garbled display) or the read faults, terminating the viewer.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 14:02 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://sourceforge.net/p/vnc-tight/bugs/1657/ | issue-tracking |
| https://www.tightvnc.com/whatsnew.php | release-notespatch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107611",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T14:02:42.563819Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T14:03:01.404Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"TightVNC Viewer (ZRLE decoder)"
],
"platforms": [
"Windows"
],
"product": "TightVNC",
"programFiles": [
"ZrleDecoder.cpp"
],
"programRoutines": [
{
"name": "readPaletteRleTile()"
},
{
"name": "readPackedPaletteTile()"
}
],
"vendor": "GlavSoft",
"versions": [
{
"lessThan": "2.8.88",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arjun Basnet from Securin"
}
],
"descriptions": [
{
"lang": "en",
"value": "An out-of-bounds read vulnerability in the ZRLE decoder of GlavSoft TightVNC Viewer for Windows before 2.8.88 allows a malicious or compromised VNC server to read heap memory beyond the palette allocation and crash the viewer by sending ZRLE-encoded tiles whose palette indices exceed the declared palette size. readPaletteRleTile() and readPackedPaletteTile() use the attacker-supplied index to look up colours without validating it against the palette size; out-of-bounds heap data is copied into the framebuffer (garbled display) or the read faults, terminating the viewer."
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T13:39:48.883Z",
"orgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"shortName": "securin"
},
"references": [
{
"name": "TightVNC bug #1657",
"tags": [
"issue-tracking"
],
"url": "https://sourceforge.net/p/vnc-tight/bugs/1657/"
},
{
"name": "TightVNC release notes (2.8.88)",
"tags": [
"release-notes",
"patch"
],
"url": "https://www.tightvnc.com/whatsnew.php"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade TightVNC for Windows to version 2.8.88 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-05-30T00:00:00.000Z",
"value": "Reported to GlavSoft"
},
{
"lang": "en",
"time": "2026-06-02T00:00:00.000Z",
"value": "Vendor acknowledged"
},
{
"lang": "en",
"time": "2026-06-19T00:00:00.000Z",
"value": "TightVNC 2.8.88 released with fix"
}
],
"title": "Out-of-bounds read in TightVNC Viewer ZRLE palette decoding",
"workarounds": [
{
"lang": "en",
"value": "Connect only to trusted VNC servers until the viewer is upgraded."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"assignerShortName": "securin",
"cveId": "CVE-2026-107611",
"datePublished": "2026-10-08T13:39:48.883Z",
"dateReserved": "2026-10-08T13:23:07.677Z",
"dateUpdated": "2026-10-08T14:03:01.404Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107615 (GCVE-0-2026-107615)
Vulnerability from cvelistv5 – Published: 2026-10-08 13:39 – Updated: 2026-10-08 14:00
VLAI
EPSS
VEX
Title
DLL search order hijacking via screenhooks libraries in TightVNC Server
Summary
An uncontrolled search path element vulnerability in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to execute arbitrary code with SYSTEM privileges. DynamicLibrary::init() (and ThemeLib) load screenhooks32.dll / screenhooks64.dll with LoadLibrary() using a bare file name and no LOAD_LIBRARY_SEARCH_* flags, so the TightVNC service follows the default DLL search order and loads an attacker-planted DLL from a writable directory earlier in that order (for example, an installation directory with permissive ACLs).
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 14:00 UTC
CWE
- CWE-427 - Uncontrolled Search Path Element
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://sourceforge.net/p/vnc-tight/bugs/1666/ | issue-tracking |
| https://www.tightvnc.com/whatsnew.php | release-notespatch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107615",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T14:00:03.531511Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T14:00:27.042Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"TightVNC Server (screen hooks loader)"
],
"platforms": [
"Windows"
],
"product": "TightVNC",
"programFiles": [
"DynamicLibrary.cpp",
"ThemeLib.cpp"
],
"programRoutines": [
{
"name": "DynamicLibrary::init()"
}
],
"vendor": "GlavSoft",
"versions": [
{
"lessThan": "2.8.88",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arjun Basnet from Securin"
}
],
"descriptions": [
{
"lang": "en",
"value": "An uncontrolled search path element vulnerability in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to execute arbitrary code with SYSTEM privileges. DynamicLibrary::init() (and ThemeLib) load screenhooks32.dll / screenhooks64.dll with LoadLibrary() using a bare file name and no LOAD_LIBRARY_SEARCH_* flags, so the TightVNC service follows the default DLL search order and loads an attacker-planted DLL from a writable directory earlier in that order (for example, an installation directory with permissive ACLs)."
}
],
"impacts": [
{
"capecId": "CAPEC-471",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-471 Search Order Hijacking"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427 Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T13:39:59.358Z",
"orgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"shortName": "securin"
},
"references": [
{
"name": "TightVNC bug #1666",
"tags": [
"issue-tracking"
],
"url": "https://sourceforge.net/p/vnc-tight/bugs/1666/"
},
{
"name": "TightVNC release notes (2.8.88)",
"tags": [
"release-notes",
"patch"
],
"url": "https://www.tightvnc.com/whatsnew.php"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade TightVNC for Windows to version 2.8.88 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-05-30T00:00:00.000Z",
"value": "Reported to GlavSoft"
},
{
"lang": "en",
"time": "2026-06-02T00:00:00.000Z",
"value": "Vendor acknowledged"
},
{
"lang": "en",
"time": "2026-06-19T00:00:00.000Z",
"value": "TightVNC 2.8.88 released with fix"
}
],
"title": "DLL search order hijacking via screenhooks libraries in TightVNC Server",
"workarounds": [
{
"lang": "en",
"value": "Ensure the TightVNC installation directory and every directory on the system PATH are writable only by administrators."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"assignerShortName": "securin",
"cveId": "CVE-2026-107615",
"datePublished": "2026-10-08T13:39:59.358Z",
"dateReserved": "2026-10-08T13:23:07.677Z",
"dateUpdated": "2026-10-08T14:00:27.042Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107614 (GCVE-0-2026-107614)
Vulnerability from cvelistv5 – Published: 2026-10-08 13:39 – Updated: 2026-10-08 14:01
VLAI
EPSS
VEX
Title
Integer underflow in TightVNC Server cursor shape trimming leads to out-of-bounds read
Summary
An integer underflow in WinCursorShapeUtils::trimTransparent() in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to crash the server, and potentially read out-of-bounds memory, by causing a cursor shape with a width or height of zero to be processed on the DXGI capture path. The loop bound width - 1 wraps to 0xFFFFFFFF, producing an access roughly 4 GB beyond the 64 KB cursor buffer; a monochrome cursor of height 1 also becomes 0 because getCursorHeight() halves the height in place.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 14:00 UTC
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://sourceforge.net/p/vnc-tight/bugs/1661/ | issue-tracking |
| https://www.tightvnc.com/whatsnew.php | release-notespatch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107614",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T14:00:49.369592Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T14:01:01.624Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"TightVNC Server (cursor shape processing)"
],
"platforms": [
"Windows"
],
"product": "TightVNC",
"programFiles": [
"WinCursorShapeUtils.cpp"
],
"programRoutines": [
{
"name": "WinCursorShapeUtils::trimTransparent()"
},
{
"name": "getCursorHeight()"
}
],
"vendor": "GlavSoft",
"versions": [
{
"lessThan": "2.8.88",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arjun Basnet from Securin"
}
],
"descriptions": [
{
"lang": "en",
"value": "An integer underflow in WinCursorShapeUtils::trimTransparent() in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to crash the server, and potentially read out-of-bounds memory, by causing a cursor shape with a width or height of zero to be processed on the DXGI capture path. The loop bound width - 1 wraps to 0xFFFFFFFF, producing an access roughly 4 GB beyond the 64 KB cursor buffer; a monochrome cursor of height 1 also becomes 0 because getCursorHeight() halves the height in place."
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "CWE-191 Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T13:39:58.297Z",
"orgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"shortName": "securin"
},
"references": [
{
"name": "TightVNC bug #1661",
"tags": [
"issue-tracking"
],
"url": "https://sourceforge.net/p/vnc-tight/bugs/1661/"
},
{
"name": "TightVNC release notes (2.8.88)",
"tags": [
"release-notes",
"patch"
],
"url": "https://www.tightvnc.com/whatsnew.php"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade TightVNC for Windows to version 2.8.88 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-05-30T00:00:00.000Z",
"value": "Reported to GlavSoft"
},
{
"lang": "en",
"time": "2026-06-02T00:00:00.000Z",
"value": "Vendor acknowledged"
},
{
"lang": "en",
"time": "2026-06-19T00:00:00.000Z",
"value": "TightVNC 2.8.88 released with fix"
}
],
"title": "Integer underflow in TightVNC Server cursor shape trimming leads to out-of-bounds read"
}
},
"cveMetadata": {
"assignerOrgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"assignerShortName": "securin",
"cveId": "CVE-2026-107614",
"datePublished": "2026-10-08T13:39:58.297Z",
"dateReserved": "2026-10-08T13:23:07.677Z",
"dateUpdated": "2026-10-08T14:01:01.624Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107613 (GCVE-0-2026-107613)
Vulnerability from cvelistv5 – Published: 2026-10-08 13:39 – Updated: 2026-10-08 14:01
VLAI
EPSS
VEX
Title
NULL pointer dereference in TightVNC Server Win8ScreenDriver after failed DXGI re-initialization
Summary
A NULL pointer dereference vulnerability in the Win8ScreenDriver component of GlavSoft TightVNC Server for Windows before 2.8.88 allows an attacker to crash the server, causing a denial of service. When re-initialization of the DXGI Desktop Duplication driver fails in applyNewScreenProperties() (for example after a GPU reset, display hot-plug or session change), m_drvImpl is left NULL and is subsequently dereferenced without a check by executeDetection(), getScreenBuffer(), grabFb(), getScreenPropertiesChanged() and getCursorPosition().
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 14:01 UTC
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://sourceforge.net/p/vnc-tight/bugs/1660/ | issue-tracking |
| https://www.tightvnc.com/whatsnew.php | release-notespatch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107613",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T14:01:21.134363Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T14:01:33.803Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"TightVNC Server (Win8/DXGI screen driver)"
],
"platforms": [
"Windows"
],
"product": "TightVNC",
"programFiles": [
"Win8ScreenDriver.cpp"
],
"programRoutines": [
{
"name": "Win8ScreenDriver::applyNewScreenProperties()"
},
{
"name": "Win8ScreenDriver::executeDetection()"
},
{
"name": "Win8ScreenDriver::getScreenBuffer()"
},
{
"name": "Win8ScreenDriver::grabFb()"
},
{
"name": "Win8ScreenDriver::getScreenPropertiesChanged()"
},
{
"name": "Win8ScreenDriver::getCursorPosition()"
}
],
"vendor": "GlavSoft",
"versions": [
{
"lessThan": "2.8.88",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arjun Basnet from Securin"
}
],
"descriptions": [
{
"lang": "en",
"value": "A NULL pointer dereference vulnerability in the Win8ScreenDriver component of GlavSoft TightVNC Server for Windows before 2.8.88 allows an attacker to crash the server, causing a denial of service. When re-initialization of the DXGI Desktop Duplication driver fails in applyNewScreenProperties() (for example after a GPU reset, display hot-plug or session change), m_drvImpl is left NULL and is subsequently dereferenced without a check by executeDetection(), getScreenBuffer(), grabFb(), getScreenPropertiesChanged() and getCursorPosition()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T13:39:56.972Z",
"orgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"shortName": "securin"
},
"references": [
{
"name": "TightVNC bug #1660",
"tags": [
"issue-tracking"
],
"url": "https://sourceforge.net/p/vnc-tight/bugs/1660/"
},
{
"name": "TightVNC release notes (2.8.88)",
"tags": [
"release-notes",
"patch"
],
"url": "https://www.tightvnc.com/whatsnew.php"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade TightVNC for Windows to version 2.8.88 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-05-30T00:00:00.000Z",
"value": "Reported to GlavSoft"
},
{
"lang": "en",
"time": "2026-06-02T00:00:00.000Z",
"value": "Vendor acknowledged"
},
{
"lang": "en",
"time": "2026-06-19T00:00:00.000Z",
"value": "TightVNC 2.8.88 released with fix"
}
],
"title": "NULL pointer dereference in TightVNC Server Win8ScreenDriver after failed DXGI re-initialization"
}
},
"cveMetadata": {
"assignerOrgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"assignerShortName": "securin",
"cveId": "CVE-2026-107613",
"datePublished": "2026-10-08T13:39:56.972Z",
"dateReserved": "2026-10-08T13:23:07.677Z",
"dateUpdated": "2026-10-08T14:01:33.803Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107612 (GCVE-0-2026-107612)
Vulnerability from cvelistv5 – Published: 2026-10-08 13:39 – Updated: 2026-10-08 14:02
VLAI
EPSS
VEX
Title
World-accessible IPC shared memory with predictable name in TightVNC Server
Summary
Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communication handles used between the TightVNC service and its desktop server process. The named shared memory segment in the Global\ namespace that carries the pipe HANDLE values is created with a NULL DACL, and its name is derived from a time-seeded srand(time(0)) value that is predictable to one-second granularity. A low-privileged local process can open the mapping and tamper with the IPC channel of a service running as SYSTEM, potentially leading to disclosure of session data, privilege escalation, or denial of service.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 14:01 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://sourceforge.net/p/vnc-tight/bugs/1658/ | issue-tracking |
| https://www.tightvnc.com/whatsnew.php | release-notespatch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107612",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T14:01:50.062814Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T14:02:27.703Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"TightVNC Server (desktop server IPC)"
],
"platforms": [
"Windows"
],
"product": "TightVNC",
"programFiles": [
"SharedMemory.cpp",
"DesktopServerWatcher.cpp"
],
"programRoutines": [
{
"name": "DesktopServerWatcher::execute()"
}
],
"vendor": "GlavSoft",
"versions": [
{
"lessThan": "2.8.88",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arjun Basnet from Securin"
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communication handles used between the TightVNC service and its desktop server process. The named shared memory segment in the Global\\ namespace that carries the pipe HANDLE values is created with a NULL DACL, and its name is derived from a time-seeded srand(time(0)) value that is predictable to one-second granularity. A low-privileged local process can open the mapping and tamper with the IPC channel of a service running as SYSTEM, potentially leading to disclosure of session data, privilege escalation, or denial of service."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-338",
"description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T13:39:55.702Z",
"orgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"shortName": "securin"
},
"references": [
{
"name": "TightVNC bug #1658",
"tags": [
"issue-tracking"
],
"url": "https://sourceforge.net/p/vnc-tight/bugs/1658/"
},
{
"name": "TightVNC release notes (2.8.88)",
"tags": [
"release-notes",
"patch"
],
"url": "https://www.tightvnc.com/whatsnew.php"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade TightVNC for Windows to version 2.8.88 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-05-30T00:00:00.000Z",
"value": "Reported to GlavSoft"
},
{
"lang": "en",
"time": "2026-06-02T00:00:00.000Z",
"value": "Vendor acknowledged"
},
{
"lang": "en",
"time": "2026-06-19T00:00:00.000Z",
"value": "TightVNC 2.8.88 released with fix"
}
],
"title": "World-accessible IPC shared memory with predictable name in TightVNC Server"
}
},
"cveMetadata": {
"assignerOrgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"assignerShortName": "securin",
"cveId": "CVE-2026-107612",
"datePublished": "2026-10-08T13:39:55.702Z",
"dateReserved": "2026-10-08T13:23:07.677Z",
"dateUpdated": "2026-10-08T14:02:27.703Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107611 (GCVE-0-2026-107611)
Vulnerability from cvelistv5 – Published: 2026-10-08 13:39 – Updated: 2026-10-08 14:03
VLAI
EPSS
VEX
Title
Out-of-bounds read in TightVNC Viewer ZRLE palette decoding
Summary
An out-of-bounds read vulnerability in the ZRLE decoder of GlavSoft TightVNC Viewer for Windows before 2.8.88 allows a malicious or compromised VNC server to read heap memory beyond the palette allocation and crash the viewer by sending ZRLE-encoded tiles whose palette indices exceed the declared palette size. readPaletteRleTile() and readPackedPaletteTile() use the attacker-supplied index to look up colours without validating it against the palette size; out-of-bounds heap data is copied into the framebuffer (garbled display) or the read faults, terminating the viewer.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 14:02 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://sourceforge.net/p/vnc-tight/bugs/1657/ | issue-tracking |
| https://www.tightvnc.com/whatsnew.php | release-notespatch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107611",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T14:02:42.563819Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T14:03:01.404Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"TightVNC Viewer (ZRLE decoder)"
],
"platforms": [
"Windows"
],
"product": "TightVNC",
"programFiles": [
"ZrleDecoder.cpp"
],
"programRoutines": [
{
"name": "readPaletteRleTile()"
},
{
"name": "readPackedPaletteTile()"
}
],
"vendor": "GlavSoft",
"versions": [
{
"lessThan": "2.8.88",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arjun Basnet from Securin"
}
],
"descriptions": [
{
"lang": "en",
"value": "An out-of-bounds read vulnerability in the ZRLE decoder of GlavSoft TightVNC Viewer for Windows before 2.8.88 allows a malicious or compromised VNC server to read heap memory beyond the palette allocation and crash the viewer by sending ZRLE-encoded tiles whose palette indices exceed the declared palette size. readPaletteRleTile() and readPackedPaletteTile() use the attacker-supplied index to look up colours without validating it against the palette size; out-of-bounds heap data is copied into the framebuffer (garbled display) or the read faults, terminating the viewer."
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T13:39:48.883Z",
"orgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"shortName": "securin"
},
"references": [
{
"name": "TightVNC bug #1657",
"tags": [
"issue-tracking"
],
"url": "https://sourceforge.net/p/vnc-tight/bugs/1657/"
},
{
"name": "TightVNC release notes (2.8.88)",
"tags": [
"release-notes",
"patch"
],
"url": "https://www.tightvnc.com/whatsnew.php"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade TightVNC for Windows to version 2.8.88 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-05-30T00:00:00.000Z",
"value": "Reported to GlavSoft"
},
{
"lang": "en",
"time": "2026-06-02T00:00:00.000Z",
"value": "Vendor acknowledged"
},
{
"lang": "en",
"time": "2026-06-19T00:00:00.000Z",
"value": "TightVNC 2.8.88 released with fix"
}
],
"title": "Out-of-bounds read in TightVNC Viewer ZRLE palette decoding",
"workarounds": [
{
"lang": "en",
"value": "Connect only to trusted VNC servers until the viewer is upgraded."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"assignerShortName": "securin",
"cveId": "CVE-2026-107611",
"datePublished": "2026-10-08T13:39:48.883Z",
"dateReserved": "2026-10-08T13:23:07.677Z",
"dateUpdated": "2026-10-08T14:03:01.404Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}