Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-107613 Overview
CVE-2026-107613 is a NULL pointer dereference vulnerability [CWE-476] in the Win8ScreenDriver component of GlavSoft TightVNC Server for Windows. The flaw affects versions before 2.8.88 and allows a remote attacker to crash the server, resulting in denial of service. The defect appears when re-initialization of the DirectX Graphics Infrastructure (DXGI) Desktop Duplication driver fails inside applyNewScreenProperties(). This failure leaves the m_drvImpl pointer set to NULL. Subsequent calls to executeDetection(), getScreenBuffer(), grabFb(), getScreenPropertiesChanged(), and getCursorPosition() dereference the pointer without a null check.
Critical Impact
A remote attacker can crash the TightVNC Server process by triggering conditions that cause DXGI reinitialization to fail, disrupting remote administration sessions.
Affected Products
- GlavSoft TightVNC Server for Windows versions prior to 2.8.88
- Win8ScreenDriver component using DXGI Desktop Duplication
- Windows deployments relying on TightVNC for remote access
Discovery Timeline
- 2026-10-08 - CVE CVE-2026-107613 published to the National Vulnerability Database
- 2026-10-08 - Last updated in NVD database
Technical Details for CVE-2026-107613
Vulnerability Analysis
The vulnerability resides in the Win8ScreenDriver component, which wraps the DXGI Desktop Duplication API to capture screen contents on modern Windows systems. During normal operation, the driver maintains an internal implementation handle in the m_drvImpl member. When screen properties change, the server invokes applyNewScreenProperties() to tear down and recreate the underlying DXGI driver instance.
If the recreation step fails, the function returns without restoring m_drvImpl to a valid state. Five subsequent operations assume the pointer is valid and dereference it directly. These operations are executeDetection(), getScreenBuffer(), grabFb(), getScreenPropertiesChanged(), and getCursorPosition(). The resulting access violation terminates the TightVNC server process.
Root Cause
The root cause is missing validation of the m_drvImpl pointer after a failed reinitialization path. The code assumes applyNewScreenProperties() either succeeds or leaves the previous driver instance intact. Neither assumption holds when DXGI driver creation fails on the retry path.
Attack Vector
An attacker on the network can reach a connected TightVNC Server and influence conditions that trigger DXGI reinitialization. These conditions include a GPU reset, a display hot-plug event, or a Windows session change. When reinitialization fails, any one of the five dereferencing functions crashes the server, severing active remote sessions. Exploitation requires no authentication and no user interaction, but attack complexity is high because the attacker must induce the specific failure state. See the SourceForge Bug Report for technical details.
Detection Methods for CVE-2026-107613
Indicators of Compromise
- Repeated unexpected termination of the tvnserver.exe process on Windows hosts
- Windows Application Event Log entries recording access violations in Win8ScreenDriver modules
- Loss of active VNC sessions coinciding with display configuration changes or GPU events
Detection Strategies
- Monitor Windows Error Reporting (WER) and crash dumps for faults originating in the TightVNC server binary
- Correlate TightVNC crashes with concurrent inbound RFB protocol traffic on TCP port 5900
- Alert on repeated service restart events for the TightVNC Server Windows service
Monitoring Recommendations
- Enable process termination logging through Sysmon Event ID 5 for tvnserver.exe
- Track DXGI subsystem errors in the Windows System Event Log alongside TightVNC process state
- Review network flow data for repeated short-lived VNC sessions suggesting induced crashes
How to Mitigate CVE-2026-107613
Immediate Actions Required
- Upgrade TightVNC Server for Windows to version 2.8.88 or later
- Restrict inbound TCP 5900 access to trusted management networks and VPN endpoints
- Enforce strong VNC authentication and TLS tunneling where supported
Patch Information
GlavSoft addressed the issue in TightVNC Server for Windows 2.8.88. Review the TightVNC Release Notes for installer downloads and upgrade guidance. The fix adds proper validation of m_drvImpl before dereference and corrects the error handling path in applyNewScreenProperties().
Workarounds
- Place TightVNC servers behind a VPN or jump host to limit network exposure
- Apply host firewall rules restricting VNC access to specific administrator IP ranges
- Configure automatic service recovery to restart tvnserver after crashes until patching completes
# Restrict TightVNC inbound traffic to a management subnet (PowerShell)
New-NetFirewallRule -DisplayName "TightVNC-Restrict" `
-Direction Inbound -Protocol TCP -LocalPort 5900 `
-RemoteAddress 10.10.50.0/24 -Action Allow
# Configure automatic restart on failure
sc.exe failure tvnserver reset= 86400 actions= restart/5000/restart/5000/restart/5000
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
