CVE-2026-128321 · Other
NO FIX YET
TightVNC and UltraVNC viewers mishandle Tight JPEG frames because a rectangle width from the server is not checked against a fixed-size buffer. A malicious VNC server can trigger an out-of-bounds heap write when a user connects, crashing the viewer and possibly corrupting memory further.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
The viewer is the vulnerable side: a team is exposed when it connects to VNC servers it does not fully trust, such as remote-support or third-party hosts. Teams that only run VNC servers, or use viewers exclusively against their own trusted servers, are less exposed. The sources do not list affected versions.
Not affected if trusted-servers-only
Who cares tightvnc, ultravnc, vnc, windows
No fix yet, per the sources.
Tight JPEG decoding in TightVNC and UltraVNC viewers contains a heap-based buffer overflow because an attacker-controlled framebuffer rectangle width is not validated against a fixed-size decoding buffer. A malicious VNC server can cause an out-of-bounds heap write when a user connects, resulting in application crash and potentially other memory-corruption impacts.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.