{"id":"TECH-202610-tightvnc-viewer-flaw-lets-a-malicious-vnc-server-or-anyone-r","kind":"technique","aliases":[],"related":[],"title":"TightVNC Viewer flaw lets a malicious VNC server, or anyone reaching a viewer in listening mode, run code on the viewer's machine before any password (silently patched, no CVE)","description":null,"summary":"SSD Secure Disclosure (2026-10-29) published a full exploit chain for TightVNC Viewer 2.8.88 x64. A server that reports a huge screen size (32768x32769 at 32bpp) makes the viewer allocate a buffer that is too small (128 KB), then write screen data at memory offsets the attacker chooses. That gives a heap leak to get around ASLR, then code execution through a ROP chain. It happens before any password is asked for, because the viewer accepts security type None. Two ways in: a viewer in listening mode (tvnviewer.exe -listen, port 5500 on all interfaces, no password, common at help desks) can be attacked over the network, and a viewer that connects to an attacker-controlled or rogue server is taken over on connect. The vendor never answered SSD and patched the bug quietly on 2026-10-03 without a security note; the fixed version is not named and there is no CVE. No attacks in the wild are reported. Help desks and admins who use TightVNC Viewer are at risk.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TightVNC","fixed":[],"affected":"2.8.88 (Viewer, x64) and likely earlier","ecosystem":"windows"}],"ecosystems":[],"tags":["early-warning","remote-desktop","technique"],"not_affected_if":[],"how_to_check":"- Find TightVNC Viewer installs (tvnviewer.exe) and their versions; 2.8.88 x64 is confirmed affected.\n- Look for tvnviewer.exe running with -listen or in Listening Mode, and for listeners on TCP 5500.\n- Fixed version: unknown (vendor patched 2026-10-03 without saying which release).","fix":"- Update TightVNC Viewer to the latest release from tightvnc.com (published after 2026-10-03).\n- Turn off viewer Listening Mode, or block inbound TCP 5500 to viewer machines at the host firewall.\n- Connect the viewer only to known, trusted VNC servers until updated.","status":"open","published_at":"2026-10-29T00:00:00+00:00","first_seen_at":"2026-10-29T15:08:20+00:00","triaged_at":"2026-10-29T15:08:20+00:00","updated_at":"2026-10-29T15:08:20+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-03':191B '-10':57B,190B '-202610':32A '-29':58B '128':90B '2.8.88':67B '2026':56B,189B '32768x32769':77B '32bpp':79B '5500':144B 'a':38A 'accept':129B 'admin':217B 'alloc':83B 'answer':181B 'anyon':10A 'anyone':43A 'around':109B 'ask':124B 'aslr':110B 'attack':100B,156B,168B,208B 'attacker-control':167B 'buffer':85B 'bug':186B 'chain':63B,117B 'choos':101B 'code':18A,112B 'common':150B 'connect':164B,177B 'control':169B 'cve':30A,206B 'data':95B 'desk':153B,215B 'desktop':51B 'disclosur':55B 'earli':47B 'early-warn':46B 'execut':113B 'exploit':62B 'fix':197B 'flaw':3A,36A 'full':61B 'get':108B 'give':103B 'happen':119B 'heap':105B 'help':152B,214B 'huge':74B 'interfac':147B 'kb':91B 'leak':106B 'let':4A 'lets':37A 'listen':15A,139B,142B 'machin':23A 'make':80B 'malici':6A 'malicious':39A 'memori':97B 'mode':16A,140B 'name':201B 'network':159B 'never':180B 'none':132B 'note':195B 'offset':98B 'or':42A 'password':26A,122B,149B 'patch':28A,184B 'port':143B 'publish':59B 'quiet':187B 'r':44A 'reach':11A 'remot':50B 'remote-desktop':49B 'report':72B,213B 'risk':224B 'rogu':171B 'rop':116B 'run':17A 'screen':75B,94B 'secur':54B,130B,194B 'server':8A,41A,70B,172B 'silent':27A 'size':76B 'small':89B 'ssd':53B,182B 'taken':174B 'tech':31A 'techniqu':52B 'tightvnc':1A,34A,45A,65B,220B 'tightvnc-viewer-flaw-lets-a-malicious-vnc-server-or-anyone-r':33A 'tvnviewer.exe':141B 'two':133B 'type':131B 'use':219B 'vendor':179B 'version':198B 'viewer':2A,13A,21A,35A,66B,82B,128B,137B,162B,221B 'vnc':7A,40A 'warn':48B 'way':134B 'wild':211B 'without':192B 'write':93B 'x64':68B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-29T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202610-tightvnc-viewer-flaw-lets-a-malicious-vnc-server-or-anyone-r","url":null,"severity":null,"published_at":"2026-10-29T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-29T15:08:20+00:00","fetched_at":"2026-10-29T15:08:20+00:00","note":null}],"documents":[{"id":17066,"url":"https://x.com/_r_netsec/status/2115814250304471351","title":"@_r_netsec: TightVNC Viewer Pre-auth RCE https://t.co/1hXLO9PijQ","kind":"post","source":"x","publisher":null,"text":"TightVNC Viewer Pre-auth RCE https://t.co/1hXLO9PijQ\n\nlikes 7 reposts 2","published_at":"2026-10-29T14:33:21+00:00","relation":"describes","confidence":null,"note":null},{"id":17250,"url":"https://t.co/1hXLO9PijQ","title":"TightVNC Viewer Pre-auth RCE - SSD Secure Disclosure","kind":"blog","source":"analyst","publisher":null,"text":"SSD Secure Disclosure (SeongJoon Cho, SSD Labs Korea), 2026-10-29. TightVNC Viewer computes framebuffer size in 32-bit int: server announcing 32768x32769 at 32bpp wraps allocation to 128 KB while canvas keeps announced dimensions; FramebufferUpdate rectangles write at attacker-chosen signed offsets (rfb/FrameBuffer.cpp getBufferSize/getBufferPtr). Full chain: heap leak via BufferedOutputStream m_dataLength to defeat ASLR, vtable overwrite, ROP to CreateProcessW. Affected: TightVNC 2.8.88 x64. Attack: viewer in listening mode (tvnviewer.exe -listen, 0.0.0.0:5500, no password) = pre-auth network RCE; or viewer connecting to an attacker-controlled/rogue server, compromised on connect before any password prompt (viewer accepts security type None). Vendor never replied; silently patched 2026-10-03 without a security note. Fixed version not named.","published_at":"2026-10-29T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}