TightVNC Viewer flaw lets a malicious VNC server, or anyone reaching a viewer in listening mode, run code on the viewer's machine before any password (silently patched, no CVE)

SSD Secure Disclosure (2026-10-29) published a full exploit chain for TightVNC Viewer 2.8.88 x64. A server that reports a huge screen size (32768x32769 at 32bpp) makes the viewer allocate a buffer that is too small (128 KB), then write screen data at memory offsets the attacker chooses. That gives a heap leak to get around ASLR, then code execution through a ROP chain. It happens before any password is asked for, because the viewer accepts security type None. Two ways in: a viewer in listening mode (tvnviewer.exe -listen, port 5500 on all interfaces, no password, common at help desks) can be attacked over the network, and a viewer that connects to an attacker-controlled or rogue server is taken over on connect. The vendor never answered SSD and patched the bug quietly on 2026-10-03 without a security note; the fixed version is not named and there is no CVE. No attacks in the wild are reported. Help desks and admins who use TightVNC Viewer are at risk.

Summary written from the sources below. Check the originals before acting.