A critical vulnerability in TightVNC Viewer has been identified, allowing attackers to execute arbitrary code on Windows systems. The flaw, reported by SeongJoon Cho from SSD Labs Korea, involves the use of a proof-of-concept exploit targeting TightVNC version 2.8.88 x64. This security issue arises when a malicious VNC server sends screen data that corrupts the memory of the viewer application.
Understanding the Vulnerability
The vulnerability affects the TightVNC Viewer, rather than any Windows machine that operates a TightVNC server. For an attack to occur, an adversary must have network access to a viewer in Listening Mode or trick a user into connecting to an attacker-controlled server. Current disclosures have not confirmed any active exploitation of this vulnerability.
The problem starts with the Remote Framebuffer protocol (RFB), where the server communicates its screen dimensions to the client. TightVNC calculates the required memory to display this screen but converts the size into a 32-bit integer. If the dimensions are excessively large, this leads to integer overflow, resulting in inadequate memory allocation.
Technical Details of the Exploit
In a provided example, a server claims a screen size of 32,768 by 32,769 pixels, utilizing 32 bits per pixel. The viewer, however, allocates just 128 KB, while the actual data exceeds 4 GB. This discrepancy causes subsequent screen updates to overwrite the allocated buffer, as there is no pointer check against the buffer size.
The proof-of-concept exploit manipulates this memory corruption into executing code. It first alters the buffer length to expose adjacent memory, identifying addresses to circumvent address randomization. It then redirects calls to execute a process using Windows’ CreateProcessW function, employing return-oriented programming techniques.
Mitigation and Recommendations
Port 5500 is particularly vulnerable in Listening Mode, as it accepts server connections without password verification or IP restrictions. Attackers can exploit this port or connect outbound to a compromised server, preceding any authentication phase.
This flaw is distinct from VNC hijacking via weak passwords or malware disguised as legitimate software. Instead, it exploits a memory handling issue within the TightVNC Viewer itself. The vendor reportedly patched the issue on October 3, 2026, although official updates were noted on October 2 and October 5. Versions 2.8.89 and 2.8.90 have addressed these security concerns, with the latter recommended for users.
Administrators should promptly update affected viewers, disable unnecessary Listening Mode, restrict access to port 5500, and avoid connecting to untrusted VNC servers. While network restrictions can lower risk, they are not substitutes for applying the necessary patches to vulnerable viewers.
