CVE-2026-107615: TightVNC Server RCE Vulnerability

CVE-2026-107615 Overview

CVE-2026-107615 is an uncontrolled search path element vulnerability [CWE-427] in GlavSoft TightVNC Server for Windows before version 2.8.88. The flaw lets a local authenticated user execute arbitrary code with SYSTEM privileges. The DynamicLibrary::init() function and ThemeLib call LoadLibrary() with bare file names (screenhooks32.dll and screenhooks64.dll) and no LOAD_LIBRARY_SEARCH_* flags. The TightVNC service then follows the default Windows DLL search order and loads an attacker-planted DLL from a writable directory earlier in that search path.

Critical Impact

A local authenticated attacker can plant a malicious DLL in a writable directory within the search path and gain SYSTEM-level code execution on the host running the TightVNC service.

Affected Products

• GlavSoft TightVNC Server for Windows versions prior to 2.8.88
• Windows installations using the vulnerable screenhooks32.dll loader path
• Windows installations using the vulnerable screenhooks64.dll loader path

Discovery Timeline

• 2026-10-08 - CVE-2026-107615 published to NVD
• 2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-107615

Vulnerability Analysis

TightVNC Server runs as a Windows service under the LocalSystem account. During initialization, the service loads screen-hook libraries used for display capture. The code paths in DynamicLibrary::init() and ThemeLib invoke LoadLibrary() with only the file name of the target DLL and omit any of the hardened LOAD_LIBRARY_SEARCH_* flags introduced to constrain library resolution.

Without these flags, Windows applies the default DLL search order. This order includes the application's installation directory, the current working directory, and other locations that may be writable by non-privileged users. A local authenticated user who can write to any directory searched before the system directories can place a malicious screenhooks32.dll or screenhooks64.dll there. The service loads the attacker-supplied DLL on next start and executes its DllMain under SYSTEM.

Root Cause

The root cause is improper library loading practice. The developer passed unqualified module names to LoadLibrary() without SetDefaultDllDirectories(), LOAD_LIBRARY_SEARCH_SYSTEM32, or an absolute path. Combined with installation directories that may carry permissive ACLs, the loader resolves attacker-controlled DLLs ahead of legitimate system binaries.

Attack Vector

An attacker with local, authenticated access identifies a directory in the TightVNC service's DLL search order that permits write access, typically the installation directory when installed with weak ACLs. The attacker drops a crafted screenhooks32.dll or screenhooks64.dll into that directory. When the TightVNC service starts or restarts, it loads the planted library and executes attacker code with SYSTEM privileges, enabling full host compromise.

No verified public exploit code is available. See the SourceForge Bug Report for additional technical details on the loader behavior.

Detection Methods for CVE-2026-107615

Indicators of Compromise

• Presence of screenhooks32.dll or screenhooks64.dll in the TightVNC installation directory with unexpected hashes, sizes, or signers.
• Unsigned or recently created DLL files in directories writable by non-administrative users that fall within the TightVNC service's search path.
• TightVNC service (tvnserver.exe) spawning unusual child processes such as cmd.exe, powershell.exe, or rundll32.exe.

Detection Strategies

• Audit the ACLs on the TightVNC installation directory and flag any entries granting write access to non-administrative principals.
• Enable Microsoft-Windows-Kernel-Process ETW or Sysmon Event ID 7 (ImageLoad) to track module loads by tvnserver.exe and alert on loads from non-system paths.
• Hunt for DLL files named screenhooks32.dll or screenhooks64.dll outside the signed TightVNC distribution set.

Monitoring Recommendations

• Monitor Windows Service Control Manager events (System log, Event IDs 7036 and 7045) for TightVNC service restarts correlated with recent file-write activity in its directory.
• Alert on process creation events where tvnserver.exe is the parent of interactive shells or scripting hosts.
• Track filesystem write events targeting screenhooks*.dll paths using EDR telemetry.

How to Mitigate CVE-2026-107615

Immediate Actions Required

• Upgrade TightVNC Server for Windows to version 2.8.88 or later on all affected hosts.
• Restrict the ACL on the TightVNC installation directory so only administrators and SYSTEM have write permissions.
• Inventory endpoints for rogue screenhooks32.dll or screenhooks64.dll instances outside the signed distribution.

Patch Information

GlavSoft addressed the vulnerability in TightVNC Server for Windows 2.8.88. Review the TightVNC Release Notes and the SourceForge Bug Report for details on the fix and affected code paths.

Workarounds

• Reinstall TightVNC to a protected location such as %ProgramFiles%\TightVNC and verify that write access is limited to privileged accounts.
• Apply icacls restrictions to the installation directory to remove inherited write permissions for standard users.
• Disable or stop the TightVNC service on hosts where remote graphical access is not required until patching completes.

# Configuration example: remove non-admin write access from the TightVNC install directory
icacls "C:\Program Files\TightVNC" /inheritance:r
icacls "C:\Program Files\TightVNC" /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F" "Users:(OI)(CI)RX"