---
id: "TECH-202610-tightvnc-viewer-flaw-lets-a-malicious-vnc-server-or-anyone-r"
kind: "technique"
aliases: []
title: "TightVNC Viewer flaw lets a malicious VNC server, or anyone reaching a viewer in listening mode, run code on the viewer's machine before any password (silently patched, no CVE)"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "TightVNC", "fixed": [], "affected": "2.8.88 (Viewer, x64) and likely earlier", "ecosystem": "windows"}]
ecosystems: []
tags: ["early-warning", "remote-desktop", "technique"]
not_affected_if: []
published_at: "2026-10-29T00:00:00+00:00"
first_seen_at: "2026-10-29T15:08:20+00:00"
updated_at: "2026-10-29T15:08:20+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-29T15:08:20+00:00"}]
---

# TightVNC Viewer flaw lets a malicious VNC server, or anyone reaching a viewer in listening mode, run code on the viewer's machine before any password (silently patched, no CVE)

SSD Secure Disclosure (2026-10-29) published a full exploit chain for TightVNC Viewer 2.8.88 x64. A server that reports a huge screen size (32768x32769 at 32bpp) makes the viewer allocate a buffer that is too small (128 KB), then write screen data at memory offsets the attacker chooses. That gives a heap leak to get around ASLR, then code execution through a ROP chain. It happens before any password is asked for, because the viewer accepts security type None. Two ways in: a viewer in listening mode (tvnviewer.exe -listen, port 5500 on all interfaces, no password, common at help desks) can be attacked over the network, and a viewer that connects to an attacker-controlled or rogue server is taken over on connect. The vendor never answered SSD and patched the bug quietly on 2026-10-03 without a security note; the fixed version is not named and there is no CVE. No attacks in the wild are reported. Help desks and admins who use TightVNC Viewer are at risk.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- windows:TightVNC affected 2.8.88 (Viewer, x64) and likely earlier fixed ?

## How to check

- Find TightVNC Viewer installs (tvnviewer.exe) and their versions; 2.8.88 x64 is confirmed affected.
- Look for tvnviewer.exe running with -listen or in Listening Mode, and for listeners on TCP 5500.
- Fixed version: unknown (vendor patched 2026-10-03 without saying which release).

## Fix

- Update TightVNC Viewer to the latest release from tightvnc.com (published after 2026-10-03).
- Turn off viewer Listening Mode, or block inbound TCP 5500 to viewer machines at the host firewall.
- Connect the viewer only to known, trusted VNC servers until updated.

## Timeline

- 2026-10-29T15:08:20+00:00 analyst

## Documents

- [describes] @_r_netsec: TightVNC Viewer Pre-auth RCE https://t.co/1hXLO9PijQ https://x.com/_r_netsec/status/2115814250304471351
- [describes] TightVNC Viewer Pre-auth RCE - SSD Secure Disclosure https://t.co/1hXLO9PijQ

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_