TightVNC Viewer Vulnerability Allows Pre-Authentication Remote Code Execution

A critical vulnerability affecting TightVNC Viewer versions prior to 2.8.90 allows unauthenticated attackers to execute arbitrary code on Windows PCs. The flaw, discovered by SeongJoon Cho of SSD Labs Korea, stems from improper handling of screen dimension data within the Remote Framebuffer protocol (RFB).

Attackers can exploit this by setting up a malicious VNC server that sends specially crafted screen size announcements. TightVNC Viewer calculates the memory required for this screen data, but a flaw in the conversion to a 32-bit integer can cause a wrap-around. This results in an unexpectedly small memory allocation for potentially massive screen dimensions, creating a buffer overflow vulnerability.

When the viewer later attempts to write screen update data into this undersized buffer, it writes beyond the allocated memory boundaries. This memory corruption is the first step in the exploit chain. The proof-of-concept (PoC) developed by the researchers demonstrates how this corruption can be leveraged to bypass security measures like Address Space Layout Randomization (ASLR).

By leaking memory addresses, the exploit gains the necessary information to precisely target memory locations. It then employs return-oriented programming (ROP) techniques, chaining together existing code snippets, to ultimately achieve code execution. The PoC successfully demonstrates launching a new process on the victim's machine via the Windows CreateProcessW function.

The vulnerability impacts TightVNC viewers that are either in Listening Mode (exposing port 5500 without authentication) or users who connect their viewer to an attacker-controlled VNC server. It's important to note that the vulnerability resides in the viewer component, not in a TightVNC server running on a machine unless a user connects to a malicious server.

While the researchers provided a PoC, they indicated that active exploitation in the wild had not been established at the time of disclosure. The vendor, TightVNC, reportedly patched the issue around October 3, 2026, with versions 2.8.89 and 2.8.90 addressing viewer security concerns. Users are strongly advised to update to version 2.8.90 or later.

To mitigate risks, administrators should ensure affected viewers are updated promptly. Additionally, disabling unnecessary Listening Mode, restricting access to port 5500 to only trusted systems, and educating users to avoid connecting to untrusted VNC servers are crucial steps. Network-level restrictions can reduce exposure but do not replace the necessity of patching the vulnerable viewer software.