VULNpocalypse
MediumVulnerabilityPatch available

TightVNC Viewer pre-auth RCE flaw with public PoC, Cyber Security News reports

Cyber Security News reports a pre-auth memory corruption flaw in TightVNC Viewer with public PoC code; update the viewer to version 2.8.90.

Published
Fixed in
TightVNC 2.8.89 and 2.8.90 (vendor recommends 2.8.90 for that branch), according to Cyber Security News
Exploitation
No, the disclosure does not establish active exploitation, though proof-of-concept code is public according to Cyber Security News

What happened

Cyber Security News reports a vulnerability in TightVNC Viewer that it says can let an attacker execute code on Windows PCs before a password prompt appears. According to the outlet, the research is credited to SeongJoon Cho of SSD Labs Korea and includes proof-of-concept exploit code targeting TightVNC 2.8.88 x64. No CVE identifier is given in the source, so a CVE is not confirmed.

According to Cyber Security News, the flaw is triggered when a malicious VNC server announces its screen size through the Remote Framebuffer (RFB) protocol. The outlet says the viewer converts the calculated buffer size into a 32-bit integer, so large dimensions wrap around and produce an allocation smaller than expected. In the reported example, the viewer allocates only 128 KB while keeping dimensions that represent more than 4 GB of pixel data, and later screen updates write outside that buffer.

The outlet says the PoC leaks nearby memory to bypass address randomization, then redirects a function call and uses return-oriented programming to launch a process through Windows’ CreateProcessW function.

On the fix, Cyber Security News reports that the researchers say the vendor did not respond and patched the issue on October 3, 2026. The outlet also notes that TightVNC’s release notices list security updates on October 2 and October 5, so the exact fix date is not confirmed. The outlet says the vendor states versions 2.8.89 and 2.8.90 address Viewer security issues and recommends 2.8.90.

Not confirmed: active exploitation in the wild (the outlet says the disclosure does not establish it), a CVE identifier, and any independent verification beyond this single report.

Am I affected?

According to Cyber Security News:

  • The affected component is the TightVNC Viewer, not simply any Windows machine running a TightVNC server.
  • The PoC targets TightVNC 2.8.88 x64. Other affected versions are not confirmed.
  • An attacker needs either network access to a viewer running in Listening Mode, or a user who connects the viewer to an attacker-controlled server.
  • The outlet says Listening Mode exposes the viewer on TCP port 5500 and accepts incoming server connections without a password or IP restriction.

What to do now

  1. Update TightVNC Viewer to 2.8.90, the version the vendor recommends according to Cyber Security News.
  2. Turn off Listening Mode on viewers that do not need it.
  3. Restrict TCP port 5500 to trusted systems.
  4. Do not connect the viewer to untrusted VNC servers.
  5. Treat network restrictions as a stopgap only. The outlet notes they reduce exposure but do not replace patching the viewer.

Sources