Skip to navigation

Threat reportVulnerabilityTL-2026-5029

TightVNC Viewer 2.8.88 x64 Pre-Authentication RCE via RFB Framebuffer Integer Overflow / Heap Buffer Overflow (No CVE) - PoC Released

highACTIVE

A 32-bit truncation in FrameBuffer::getBufferSize() in TightVNC Viewer 2.8.88 x64 for Windows lets a malicious or spoofed VNC server announce screen dimensions that wrap a ~4 GB allocation to ~128 KB, giving a server-controlled out-of-bounds write and code execution before authentication.

Key facts for TightVNC Viewer pre-auth RCE

IdentifiersTL-2026-5029
Also known asTightVNC Viewer Pre-auth RCE
SeverityHIGH
First disclosed
Exploitation statusPublic proof-of-concept exploit
Affected productsTightVNC TightVNC Viewer (Windows x64)
Weaknesses (CWE)CWE-190, CWE-122, CWE-787
ToolsSSD TightVNC Viewer pre-auth RCE PoC (malicious RFB server), TightVNC, VNC
MITRE ATT&CK techniquesT1021.005 VNC, T1106 Native API, T1190 Exploit Public-Facing Application, T1203 Exploitation for Client Execution
MotivationUNKNOWN
Target sectorsit-services, managed-service-providers, enterprise, education
Target regionsGlobal
Detection rules9 (1 shown free)
Sources6 cited sources

Detection coverage for TightVNC Viewer pre-auth RCE

As of 2026-11-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5029 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Shell, Script Host or LOLBin Launched by TightVNC Viewer - Post-Exploitation

TL-2026-5029: detects tvnviewer.exe launching a command interpreter, script host or common living-off-the-land binary (cmd, PowerShell, wscript, mshta, rundll32, certutil, bitsadmin and similar). After the ROP chain calls CreateProcessW, attackers typically start a shell or downloader running with the privileges of the user who ran the viewer.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1203, T1059, T1059.001, T1059.003
  • Data sources: sysmon, microsoft_defender_for_endpoint
  • Severity: critical
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ParentImage="*tvnviewer.exe" Image IN ("*cmd.exe","*powershell.exe","*pwsh.exe","*wscript.exe","*cscript.exe","*mshta.exe","*rundll32.exe","*regsvr32.exe","*certutil.exe","*bitsadmin.exe","*curl.exe","*msiexec.exe","*schtasks.exe","*wmic.exe")
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as child_image values(CommandLine) as child_cmdline by host User ParentCommandLine
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| table host User ParentCommandLine child_image child_cmdline count first_seen last_seen

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "tvnviewer.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "msiexec.exe", "schtasks.exe", "wmic.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by Timestamp desc

Sigma

title: Shell or LOLBin Spawned by TightVNC Viewer
id: 8d2e4f60-1a7b-4c35-b9e8-3c5a6d7f0b04
status: experimental
description: Detects tvnviewer.exe launching a command interpreter, script host or living-off-the-land binary, the expected post-exploitation step after the TightVNC Viewer pre-auth RCE ROP chain reaches CreateProcessW.
references:
  - https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
  - attack.t1059.001
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\tvnviewer.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\msiexec.exe'
      - '\schtasks.exe'
      - '\wmic.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Unlikely; the viewer does not normally launch interpreters or LOLBins
level: critical

Known false positives:

  • Administrators who deliberately launch a command prompt from the viewer through a custom wrapper
  • Endpoint management agents that run cmd.exe or msiexec.exe from a process tree rooted at tvnviewer.exe during upgrades

Tuning notes: Treat as a high-fidelity alert and isolate the host first. If msiexec.exe from an upgrade workflow is noisy, scope that exclusion to the exact command line of your deployment package.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Vulnerable TightVNC Viewer 2.8.88 Executed - Exposure Inventory · unlock with TL Creds
  • Recon, Encoded or Download-Cradle Command Lines Spawned by TightVNC Viewer · unlock with TL Creds
  • TightVNC Viewer Connecting Out to Public VNC Server - Rogue RFB Server Exposure · unlock with TL Creds
  • TightVNC Viewer Started in Listening Mode ([indicator] -listen) · unlock with TL Creds
  • Executable or Script Written to Disk by TightVNC Viewer · unlock with TL Creds
  • Inbound TCP/5500 Connection Accepted by TightVNC Viewer (Listening Mode) · unlock with TL Creds
  • TightVNC Viewer ([indicator]) Spawning Child Process - Pre-Auth RCE Outcome · unlock with TL Creds
  • TightVNC Viewer or Its Children Connecting Out to Public IPs Beyond RFB - Post-Exploitation C2 · unlock with TL Creds

Indicators of compromise for TightVNC Viewer pre-auth RCE

As of 2026-11-02, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-5029.

8 indicators of compromise · unlock with TL Creds. Compare plans

How TightVNC Viewer pre-auth RCE works

A public PoC chains an ASLR leak and a ROP chain to CreateProcessW; the fix shipped silently in 2.8.89 and 2.8.90 (recommended) with no CVE assigned.

SSD Secure Disclosure published research by SeongJoon Cho (SSD Labs Korea) on a pre-authentication remote code execution flaw in TightVNC Viewer 2.8.88 x64 on Windows. The root cause is in the Remote Framebuffer (RFB) handling: FrameBuffer::getBufferSize() computes the framebuffer size in 64 bits ((UINT64)area * bitsPerPixel / 8) but returns it through an (int) cast. A server that announces 32768 x 32769 pixels at 32 bits per pixel makes the roughly 4 GB requirement wrap to about 128 KB, while the viewer keeps the announced dimensions as its logical canvas. Later pixel writes use a 32-bit, unchecked offset calculation; a large y value overflows the product and sign-extends it, so the write lands at an attacker-chosen positive or negative offset from the undersized heap buffer.

There are two pre-authentication exposure scenarios. In Listening Mode (tvnviewer.exe -listen) the viewer binds 0.0.0.0:5500 with no password or IP restriction, so the bug is reachable directly from the network. In the outbound scenario, a user connects the viewer to an attacker-controlled or spoofed VNC server and exploitation occurs before any password prompt, because RFB authentication is one-directional: servers challenge viewers and viewers never challenge servers.

The public proof-of-concept has three stages. Stage 1 poisons BufferedOutputStream::m_dataLength to leak roughly 100 KB of adjacent heap, recovering the image base (ASLR bypass) and the framebuffer location. Stage 2 builds a fake object and a ROP chain inside the 128 KB framebuffer at a controlled offset. Stage 3 overwrites the BufferedOutputStream vtable pointer so the next virtual call pivots the stack into the ROP chain, which ultimately invokes CreateProcessW. Code runs with the privileges of the user who launched the viewer.

Per SSD, the vendor never answered the report and patched the issue on 3 October 2026 without a security notice. Secondary reporting dates the fixes as 2.8.89 (2 October 2026) and 2.8.90 (5 October 2026, also patching the Tight decoder), with the 4.0.x branch (4.0.2, 28 October 2026) as an alternative. No CVE was assigned, so vulnerability scanners and fleet-management tooling are unlikely to flag vulnerable installs. The sources do not report in-the-wild exploitation; severity HIGH is analyst-assigned because no CVSS score was published. No network IOCs are published, so no BeaconBeagle correlation applied.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.005 VNC

Execution

T1106 Native API; T1203 Exploitation for Client Execution

Initial Access

T1190 Exploit Public-Facing Application

Remediation for TightVNC Viewer pre-auth RCE

Patches

  • TightVNC 2.8.89 (first fixed build, minimal announcement)
  • TightVNC 2.8.90 (recommended; also patches the Tight decoder)
  • TightVNC 4.0.2 (current branch alternative)

Immediate actions

  • Upgrade all TightVNC Viewer 2.8.88 x64 installs to 2.8.90 (vendor-recommended)
  • Turn off Listening Mode (tvnviewer.exe -listen) when not in use
  • Restrict inbound TCP 5500 to trusted systems with host or network firewall rules
  • Do not connect the viewer to untrusted or unverified VNC servers

Workarounds

  • Disable Listening Mode
  • Block inbound TCP 5500 at the perimeter and on hosts
  • Use an alternative remote-access client until patched

Longer-term hardening

  • Inventory TightVNC Viewer installs by file version, because no CVE exists for scanners to key on
  • Run the viewer without administrative privileges
  • Segment VNC traffic and require VPN access to VNC endpoints
  • Monitor for tvnviewer.exe spawning child processes

Affected and fixed versions

  • TightVNC — TightVNC Viewer (Windows x64)
    Vulnerable versions: 2.8.88 x64
    Fixed in: 2.8.89; 2.8.90 (recommended); 4.0.2

Timeline of TightVNC Viewer pre-auth RCE

  • locked-ioc-5 released with the fix and only a minimal announcement (per secondary reporting)
  • Per SSD, the vendor patched the vulnerability without mentioning a security fix and never responded to the researcher's report
  • locked-ioc-6 released; vendor-recommended build that also patches the Tight decoder (per secondary reporting)
  • TightVNC 4.0.2 released on the new branch (per secondary reporting)
  • locked-ioc-4 published the technical write-up and PoC details by locked-ioc-8 (SSD Labs Korea); no CVE assigned
  • DEV Community article summarized the integer overflow and server-controlled out-of-bounds write
  • Cyber Security News reported the PoC and mitigations; no in-the-wild exploitation was reported in the source

Sources cited for TightVNC Viewer pre-auth RCE

Drafted by the Threadlinqs research pipeline from 6 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats