Zero Radar
← feed
CriticalVulnerabilityupdated 29 Oct 2026, 14:09 UTC

TightVNC Viewer can be crashed or hijacked by a malicious server

A rogue VNC server you connect to can send data that tricks your TightVNC viewer into writing memory it should not touch. This can crash the viewer or possibly let an attacker run their own code on your computer.

Unverified
SeverityCriticalVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?UnverifiedOnly one publisher so far, details may change

How the attack works simplified

  1. 1Rogue VNC serverAttacker runs a malicious VNC server
  2. 2Crafted screen sizeAnnounces 32768 x 32769 at 32 bpp
  3. 3Integer overflowBuffer size wraps down to 128 KB
  4. 4Out-of-bounds writeViewer writes past the small buffer
  5. ResultViewer memory corrupted, possible code execution

What happened

TightVNC Viewer's framebuffer size calculation overflows when a server announces a crafted 32768 x 32769 screen at 32 bpp, so the allocation wraps to about 128 KB while pixel writes still use the original large dimensions, causing an out-of-bounds write.

Why it is dangerous: Anyone who connects to an untrusted or spoofed VNC server with a vulnerable viewer can have memory corrupted before authentication, with possible remote code execution on the viewer's machine.

Are you affected?

You are affected if you run a vulnerable TightVNC Viewer and connect to VNC servers you do not fully trust.

TightVNC Viewer (versions not specified in the source)

What to do

  1. Avoid connecting TightVNC Viewer to VNC servers you do not fully trust
  2. Check the TightVNC project for an updated Viewer release and install it when available
  3. Use an alternative VNC viewer or a VPN-tunneled connection until a fix is confirmed

Timeline

  1. 29 Oct 2026, 14:09 UTC
    Publicly disclosed
  2. 29 Oct 2026, 14:09 UTC
    Reported by r/netsec · r/netsec
  3. 29 Oct 2026, 14:09 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Community discussion sites, treat with care

Technical details

ID
ZR-200f5172
Disclosed
29 Oct 2026, 14:09 UTC
On Zero Radar
29 Oct 2026, 14:09 UTC (0 min after disclosure)
Last change
29 Oct 2026, 14:09 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

TightVNC Viewer can be crashed or hijacked by a malicious server · Zero Radar