CVE-2026-107612: TightVNC Server Privilege Escalation Flaw

CVE-2026-107612 Overview

CVE-2026-107612 is a local privilege escalation vulnerability in GlavSoft TightVNC Server for Windows before version 2.8.88. The TightVNC service creates a named shared memory segment in the Global\ namespace with a NULL discretionary access control list (DACL). The segment name is derived from srand(time(0)), making it predictable to one-second granularity. A local authenticated user can open the mapping and read or overwrite the inter-process communication (IPC) pipe handles exchanged between the TightVNC service and its desktop server process. The flaw is tracked under CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator.

Critical Impact
A low-privileged local process can tamper with an IPC channel of a service running as SYSTEM, enabling session data disclosure, privilege escalation to SYSTEM, or denial of service.

Affected Products

GlavSoft TightVNC Server for Windows versions prior to 2.8.88
Windows deployments exposing the TightVNC service to multi-user or terminal-server environments
Any host where TightVNC runs as a SYSTEM service alongside interactive user sessions

Discovery Timeline

2026-10-08 - CVE-2026-107612 published to the National Vulnerability Database
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-107612

Vulnerability Analysis

The TightVNC Windows service and its desktop server process communicate through anonymous pipes. To exchange pipe HANDLE values across process boundaries, the service publishes them in a named file mapping located in the Global\ namespace. Two independent defects make this channel attacker-reachable from a low-privileged session.

First, the mapping is created with a NULL DACL. Any authenticated local user obtains full read and write access to the shared memory region. Second, the mapping name is derived from values produced by srand(time(0)) followed by rand(). The seed space collapses to the current Unix timestamp in seconds, so an attacker running concurrently on the same host can enumerate candidate names in a trivial brute-force window.

Once the attacker opens the mapping, the stored pipe handles become fully controllable. The attacker can read responses intended for the SYSTEM service or substitute handles pointing at pipes under attacker control, hijacking the IPC channel.

Root Cause

The root cause is twofold: a weak pseudo-random name generator seeded with wall-clock time ([CWE-338]) and a NULL DACL on a Global\ kernel object. Together they violate the confidentiality and integrity assumptions of the IPC design. The service treats the named section as a private rendezvous even though its name is guessable and its ACL is open.

Attack Vector

Exploitation requires only local authenticated access on a host running a vulnerable TightVNC service. The attacker enumerates Global\ section names derived from timestamps around the service start time, opens the matching mapping, and reads or overwrites the embedded pipe handles. Replacing a handle with one owned by the attacker causes the SYSTEM service to write session data to, or read commands from, the attacker's pipe. This yields session data disclosure, SYSTEM-level privilege escalation, or service denial if the handles are corrupted.

No verified exploit code is publicly available. Technical specifics are documented in the SourceForge Bug Report #1658 and the TightVNC Release Notes.

Detection Methods for CVE-2026-107612

Indicators of Compromise

Unexpected processes opening file mapping objects under the Global\ namespace whose names match the TightVNC naming pattern
Non-SYSTEM processes holding handles to TightVNC-owned named pipes
TightVNC service crashes, desktop server restarts, or abnormal session disconnects without a corresponding user action
New SYSTEM-level child processes spawned by tvnserver.exe or its desktop helper

Detection Strategies

Hunt for NtOpenSection or OpenFileMappingW calls targeting Global\ names made by processes other than tvnserver.exe
Correlate TightVNC service start times with subsequent handle-enumeration activity from low-privileged users
Alert on anonymous pipe handle duplication between the TightVNC service and processes outside its expected process tree

Monitoring Recommendations

Enable Sysmon Event IDs 7, 10, and 17 to capture image loads, process access, and named pipe creation involving TightVNC binaries
Forward Windows Security object-access auditing for file mapping objects in the Global\ namespace to a centralized logging platform
Baseline the parent-child process relationships of tvnserver.exe and alert on deviations

How to Mitigate CVE-2026-107612

Immediate Actions Required

Upgrade GlavSoft TightVNC Server for Windows to version 2.8.88 or later on all affected hosts
Inventory endpoints running TightVNC, prioritizing multi-user systems, jump servers, and terminal servers
Restrict interactive logon rights on TightVNC-hosting systems to trusted administrators until patching completes

Patch Information

TightVNC 2.8.88 addresses the vulnerability by replacing the predictable mapping name scheme and applying a restrictive DACL to the shared memory section. Refer to the TightVNC Release Notes for the official changelog and the SourceForge Bug Report #1658 for the underlying technical discussion.

Workarounds

Stop and disable the TightVNC service on hosts where remote desktop is not required
Block non-administrative local logons on servers running vulnerable TightVNC builds
Replace TightVNC with a remote access product that enforces per-session isolation until the patch is deployed

bash

# Verify installed TightVNC version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\TightVNC\Server" | Select-Object -Property ProductVersion

# Stop and disable the service as a temporary mitigation
Stop-Service -Name tvnserver
Set-Service -Name tvnserver -StartupType Disabled