TightVNC Viewer flaw allows pre-authentication code execution on Windows, PoC published
- Severity
- High
- Sources
- 1
What happened
TightVNC Viewer 2.8.88 x64 is affected by a pre-auth RCE caused by a 32-bit integer overflow when computing framebuffer allocation from server-announced RFB screen dimensions. A 32,768x32,769 screen at 32 bpp yields a 128 KB allocation while retaining more than 4 GB of pixel geometry, so later updates write out of bounds. The public PoC leaks memory to defeat ASLR and uses ROP to call CreateProcessW. Exposure exists via Listening Mode on TCP 5500 without authentication or IP restriction, or via outbound connection to a rogue server. No CVE ID is given in the source. Update to 2.8.90 (2.8.89 also cited), disable Listening Mode where unneeded, restrict port 5500, and avoid untrusted VNC servers.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Update TightVNC Viewer to version 2.8.90, the recommended version for that branch, or at least 2.8.89.
- Turn off Listening Mode in the viewer when it is not needed.
- Restrict access to TCP port 5500 to trusted systems only.
- Avoid connecting the viewer to untrusted VNC servers.
Written by AI from the sources, checked against them