Pre-auth server-to-viewer heap write enabling RCE in listening mode (TightVNC Viewer)
A complete working exploit is public and the fix shipped without a security note, so operators may be unaware they are running a vulnerable build.
SSD Secure Disclosure published a full write-up and exploit for a pre-authentication RCE in the TightVNC viewer. The viewer computes the framebuffer allocation size in a 32-bit int, so a malicious server announcing 32768x32769 at 32bpp wraps the allocation to 128 KB while keeping the 4 GB logical canvas; unchecked 32-bit pointer arithmetic then yields a server-controlled write at arbitrary offsets, chained to a leak and ROP for code execution. In listening mode (tvnviewer.exe -listen, binding 0.0.0.0:5500 with no password) this is reachable over the network with no user action. SSD says the vendor silently patched on 2026-10-03 without a security note and never responded; no CVE is assigned. Source is not on the allowlist.
Affected: TightVNC 2.8.88 x64
How to Test
Check viewer version via Help > About for 2.8.88 (x64); determine whether listening mode is enabled (tvnviewer.exe -listen or the GUI Listening Mode) and whether TCP/5500 is exposed. No indicators of compromise are provided in the report.
How to Patch
Install the current TightVNC viewer release that includes the 2026-10-03 fix; as interim mitigation stop using listening mode and restrict/ block inbound TCP/5500.