Researchers have discovered a serious security vulnerability in TightVNC Viewer version 2.8.88 x64 that allows attackers to execute arbitrary code on Windows machines before any password prompt appears. At issue is a flaw in how the viewer handles screen dimension data sent from the server via the Remote Framebuffer (RFB) protocol. A proof-of-concept (PoC) exploit confirms this vulnerability. The problem stems from converting required memory size into a 32-bit integer, which causes it to wrap around when the dimensions are excessively large. As a result, the viewer allocates far less memory than needed but continues to believe it has allocated enough, creating a buffer overflow scenario.
The defect affects only the Viewer component—the program that connects to remote VNC servers—rather than servers themselves. Two exploitation setups are possible: either a network-accessible Viewer running in “Listening Mode” or a user connecting that Viewer to a malicious server. In either case, the vulnerable Viewer can be attacked before login credentials are requested.
How the Exploit Works
In demonstrations, researchers simulated a server broadcasting a screen size of 32,768 × 32,769 with 32 bits per pixel. Despite the huge pixel data this implies (well over 4 GB), the buffer allocated is just 128 KB due to the integer overflow. When the server later sends screen updates, writes overflow outside the buffer because there’s no check that the data fits. The exploit’s PoC takes advantage of this to first leak memory via manipulation of an outgoing buffer, extracting needed memory addresses to defeat address space layout randomization (ASLR). It then hijacks control flow using return-oriented programming techniques to invoke Windows’ CreateProcessW, thereby running arbitrary code.
Impact, Fixes & Mitigation
The Viewer’s Listening Mode opens a TCP port (5500) that accepts server connections without requiring authentication or IP restrictions—making it especially vulnerable. Alternatively, connecting to a malicious VNC server also opens the same risk, and the exploit triggers before any credentials are verified.
The vendor addressed the issue in updated Viewer builds (versions 2.8.89 and 2.8.90). Users running earlier versions should upgrade immediately. Administrators are advised to disable Listening Mode unless strictly necessary, block or restrict access to port 5500, and avoid connecting to untrusted VNC servers. While network-level restrictions are helpful, they are no substitute for applying the patches.
The timeline of disclosure remains slightly fuzzy: the patch was released around October 3, 2026, though vendor notices also mention security updates on October 2 and October 5. Regardless of the exact date, the fixes are included in the 2.8.89/2.8.90 releases for the Viewer branch.
Ultimately, this flaw isn’t just another VNC credential bypass or installer trick—it comes down to a core memory-handling bug in the Viewer itself. Attackers with access to the Viewer via network or through a connected server can exploit it without ever touching the login prompt.
Why this matters: TightVNC remains widely used in corporate and support environments, especially for remote desktop access. A pre-auth remote code execution vulnerability means that attackers could gain full control of a machine without needing any credentials. In environments where remote access tools are trusted implicitly—such as in help desks or remote support setups—this creates a catastrophic risk. Going forward, any remote access tool must be scrutinized for memory safety, and users must adopt strict network restrictions, avoid unnecessary listening services, and apply vendor updates immediately.
