CVE-2026-107614: TightVNC Server Buffer Overflow Vulnerability

CVE-2026-107614 Overview

CVE-2026-107614 is an integer underflow vulnerability in GlavSoft TightVNC Server for Windows before version 2.8.88. The flaw resides in the WinCursorShapeUtils::trimTransparent() function on the DXGI capture path. A local authenticated user can crash the server and potentially read out-of-bounds memory by submitting a cursor shape with a width or height of zero. The loop bound width - 1 wraps to 0xFFFFFFFF, producing memory access approximately 4 GB beyond the 64 KB cursor buffer. The issue is tracked as [CWE-125] Out-of-Bounds Read.

Critical Impact

A local authenticated attacker can crash the TightVNC Server process and potentially disclose adjacent process memory through a malformed cursor shape.

Affected Products

• GlavSoft TightVNC Server for Windows versions prior to 2.8.88
• Deployments using the DXGI screen capture path
• Windows systems running TightVNC Server with authenticated local sessions

Discovery Timeline

• 2026-10-08 - CVE-2026-107614 published to NVD
• 2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-107614

Vulnerability Analysis

The vulnerability occurs in the WinCursorShapeUtils::trimTransparent() function used by TightVNC Server on its DXGI capture path. The function iterates over cursor shape pixels using width - 1 as a loop bound. When the cursor width is zero, the unsigned subtraction underflows to 0xFFFFFFFF. The resulting loop reads approximately 4 GB beyond the 64 KB cursor buffer, well outside any valid allocation.

A parallel condition exists for cursor height. The getCursorHeight() helper halves the height in place to account for monochrome cursor masks. A monochrome cursor with height 1 becomes 0 after this division, triggering the same underflow condition on the height axis.

The out-of-bounds access causes an access violation that terminates the TightVNC Server process. Before the crash, the loop reads adjacent memory, which creates a window for information disclosure if the attacker can observe memory contents reflected into cursor frames sent back to the client.

Root Cause

The root cause is missing input validation on cursor shape dimensions before arithmetic on unsigned integer loop bounds. The code assumes width and height are both greater than zero. Neither the DXGI capture layer nor trimTransparent() enforces this precondition, allowing attacker-controlled dimensions to flow directly into pointer arithmetic.

Attack Vector

Exploitation requires local authenticated access to a system running vulnerable TightVNC Server. The attacker causes a cursor shape with a width or height of zero to be processed through the DXGI capture path. This triggers the underflow in trimTransparent(), crashing the server and inducing out-of-bounds memory reads. No user interaction is required beyond the initial authenticated session.

Technical references are available in the SourceForge Bug Report and the TightVNC Release Notes.

Detection Methods for CVE-2026-107614

Indicators of Compromise

• Unexpected termination of the tvnserver.exe process with access violation exit codes
• Windows Error Reporting (WER) entries referencing tvnserver.exe and faulting module addresses outside loaded module ranges
• Repeated TightVNC service restarts correlated with authenticated user sessions

Detection Strategies

• Monitor process crash telemetry for tvnserver.exe and correlate with the active local user session at the time of failure
• Alert on TightVNC Server versions below 2.8.88 discovered during software inventory scans
• Review DXGI capture path initialization events and malformed cursor shape updates in server-side logs where available

Monitoring Recommendations

• Collect Windows crash dumps for tvnserver.exe and inspect faulting instruction pointers for addresses near cursor buffer regions
• Track installation and version metadata of TightVNC across managed Windows endpoints
• Enable Event Tracing for Windows (ETW) collection on process termination events to establish a baseline for unexpected VNC service failures

How to Mitigate CVE-2026-107614

Immediate Actions Required

• Upgrade TightVNC Server for Windows to version 2.8.88 or later on all affected hosts
• Restrict interactive logon rights on systems hosting TightVNC Server to trusted administrators only
• Audit existing TightVNC deployments and remove installations that are no longer required

Patch Information

GlavSoft addressed the vulnerability in TightVNC Server for Windows 2.8.88. The fix validates cursor shape dimensions before performing arithmetic on loop bounds in WinCursorShapeUtils::trimTransparent(). Review the TightVNC Release Notes for upgrade procedures and version-specific notes.

Workarounds

• Disable the DXGI capture path and fall back to a legacy capture mode if operationally acceptable until patching is complete
• Limit TightVNC Server exposure to accounts that require it by applying Windows access control on the service binary and configuration
• Terminate the TightVNC service on hosts where local authenticated users are untrusted until the upgrade is deployed

# Query installed TightVNC version on Windows via PowerShell
Get-ItemProperty 'HKLM:\SOFTWARE\TightVNC\Server' | Select-Object -Property *

# Stop and disable the TightVNC service pending patch
Stop-Service -Name tvnserver
Set-Service -Name tvnserver -StartupType Disabled