TightVNC Viewer Pre-Auth RCE PoC Exploits Framebuffer Integer Overflow

A disclosed pre-authentication remote code execution vulnerability in TightVNC Viewer allows an attacker-controlled VNC server to corrupt memory through crafted screen dimensions and framebuffer updates. Research credited to SeongJoon Cho of SSD Labs Korea includes proof-of-concept exploit code targeting TightVNC 2.8.88 x64. A server advertising a 32768 × 32769 screen at 32 bits per pixel causes a 32-bit framebuffer allocation calculation to overflow, allocating only 128 KB instead of roughly 4 GB. The viewer retains the original dimensions for pixel writes, enabling server-controlled out-of-bounds writes. The supplied reporting does not establish active exploitation.

Exploitation requires an attacker to reach a viewer running Listening Mode on TCP port 5500 or persuade a user to connect to a malicious VNC server; this is a viewer-side flaw, not an unrestricted attack against every VNC server. TightVNC identifies versions 2.8.89 and 2.8.90 as addressing Viewer security issues and recommends 2.8.90 for that branch, although reported patch dates conflict. Administrators should update affected viewers, disable unnecessary Listening Mode, restrict inbound access to port 5500, and prevent connections to untrusted VNC servers.