CVE-2026-107611: TightVNC Viewer Buffer Overflow Vulnerability

CVE-2026-107611 Overview

CVE-2026-107611 is an out-of-bounds read vulnerability [CWE-125] in the Zlib Run-Length Encoding (ZRLE) decoder of GlavSoft TightVNC Viewer for Windows before version 2.8.88. A malicious or compromised Virtual Network Computing (VNC) server can send crafted ZRLE-encoded tiles whose palette indices exceed the declared palette size. The viewer's readPaletteRleTile() and readPackedPaletteTile() functions use these attacker-supplied indices to look up colours without validating them against the palette size. The result is heap memory being read past the palette allocation, producing either a garbled framebuffer display or a crash of the viewer process.

Critical Impact
A hostile VNC server can crash connected TightVNC Viewer clients and read adjacent heap memory, impacting client-side confidentiality and availability.

Affected Products

GlavSoft TightVNC Viewer for Windows versions before 2.8.88
Deployments using the bundled ZRLE decoder for VNC session rendering
Workstations connecting to untrusted or potentially compromised VNC servers

Discovery Timeline

2026-10-08 - CVE-2026-107611 published to the National Vulnerability Database (NVD)
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-107611

Vulnerability Analysis

The flaw resides in the client-side ZRLE tile decoder. ZRLE is a VNC encoding that compresses rectangles using zlib and may represent pixels through a palette of colours referenced by index. When a server transmits a ZRLE tile using palette or packed-palette sub-encoding, the viewer must map each index back to a colour entry in the palette array.

TightVNC Viewer trusts the server-supplied indices. The decoder reads indices from the compressed stream and dereferences the palette array without checking that the index is less than the declared palette size. The resulting read occurs on heap memory immediately following the palette allocation.

Two outcomes are possible. Out-of-bounds heap bytes may be copied into the framebuffer, exposing adjacent heap contents visually and corrupting the rendered display. Alternatively, the read may touch unmapped memory and raise an access violation, terminating the viewer.

Root Cause

The root cause is missing bounds validation in readPaletteRleTile() and readPackedPaletteTile(). Both functions accept the palette index parsed from the network stream and apply it directly to the palette lookup. Neither function compares the index against the palette length declared earlier in the tile header, violating the input-validation requirement for untrusted protocol data [CWE-125].

Attack Vector

Exploitation requires a victim to initiate a VNC session to an attacker-controlled or compromised VNC server. User interaction is required to connect, but no authentication on the viewer side is needed once the session is established. The server negotiates ZRLE encoding, then sends a tile declaring a small palette while embedding indices that exceed that palette size. The viewer decodes the tile, performs the invalid lookup, and either leaks heap bytes into the visible framebuffer or crashes.

The vulnerability is network-reachable but server-to-client, meaning the attack path inverts the typical VNC threat model: the server attacks the viewer. No code execution has been demonstrated; impact is limited to information disclosure through rendered pixels and denial of service.

See the SourceForge Bug Report #1657 for additional technical details on the decoder behavior.

Detection Methods for CVE-2026-107611

Indicators of Compromise

Unexpected termination of tvnviewer.exe processes shortly after establishing a VNC session
Visibly garbled or corrupted tile rendering during a remote session that cannot be explained by network loss
Windows Error Reporting entries citing access violations in the TightVNC Viewer ZRLE decode path

Detection Strategies

Inventory endpoints running TightVNC Viewer and flag any installation with a version prior to 2.8.88
Monitor process-termination telemetry for tvnviewer.exe crashes correlated with outbound TCP connections to VNC ports (typically 5900–5906)
Alert on VNC sessions initiated to servers outside approved IP ranges, since the attack requires connecting to a hostile server

Monitoring Recommendations

Capture network metadata for VNC flows and retain source and destination for forensic correlation with viewer crashes
Track installed-software inventory for TightVNC Viewer version drift across managed Windows endpoints
Review Windows Application event logs for faulting-module entries referencing TightVNC binaries

How to Mitigate CVE-2026-107611

Immediate Actions Required

Upgrade all Windows installations of TightVNC Viewer to version 2.8.88 or later
Restrict outbound connections from managed endpoints to known and trusted VNC servers only
Advise users not to connect to VNC servers hosted on untrusted networks or provided by unverified parties

Patch Information

GlavSoft addressed CVE-2026-107611 in TightVNC Viewer for Windows version 2.8.88. The fix adds bounds validation to readPaletteRleTile() and readPackedPaletteTile() so palette indices are checked against the declared palette size before dereferencing the palette array. Refer to the TightVNC What's New Update for release details.

Workarounds

Disable ZRLE encoding in viewer connection options and prefer alternative encodings such as Tight or Hextile when connecting to servers of uncertain trust
Route VNC traffic exclusively through authenticated VPN tunnels so viewer clients cannot reach arbitrary internet-exposed servers
Enforce host-based firewall rules that limit tvnviewer.exe to approved destination addresses

bash

# Example: Windows Defender Firewall rule restricting TightVNC Viewer to a specific server
New-NetFirewallRule -DisplayName "TightVNC Viewer - Approved Server Only" `
  -Direction Outbound `
  -Program "C:\Program Files\TightVNC\tvnviewer.exe" `
  -RemoteAddress 10.20.30.40 `
  -RemotePort 5900 `
  -Protocol TCP `
  -Action Allow

New-NetFirewallRule -DisplayName "TightVNC Viewer - Block Other" `
  -Direction Outbound `
  -Program "C:\Program Files\TightVNC\tvnviewer.exe" `
  -Action Block