# TightVNC Viewer 2.8.88 x64 Pre-Authentication RCE via RFB Framebuffer Integer Overflow / Heap Buffer Overflow (No CVE) - PoC Released

> A 32-bit truncation in FrameBuffer::getBufferSize() in TightVNC Viewer 2.8.88 x64 for Windows lets a malicious or spoofed VNC server announce screen dimensions that wrap a ~4 GB allocation to ~128 KB, giving a server-controlled out-of-bounds write and code execution before authentication. A public PoC chains an ASLR leak and a ROP chain to CreateProcessW; the fix shipped silently in 2.8.89 and 2.8.90 (recommended) with no CVE assigned.

- **Published:** 2026-11-02T04:38:28Z
- **Last reviewed:** 2026-11-02T04:38:28Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5029
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5029.png
- **ID:** TL-2026-5029
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 8

## Description

SSD Secure Disclosure published research by SeongJoon Cho (SSD Labs Korea) on a pre-authentication remote code execution flaw in TightVNC Viewer 2.8.88 x64 on Windows. The root cause is in the Remote Framebuffer (RFB) handling: FrameBuffer::getBufferSize() computes the framebuffer size in 64 bits ((UINT64)area * bitsPerPixel / 8) but returns it through an (int) cast. A server that announces 32768 x 32769 pixels at 32 bits per pixel makes the roughly 4 GB requirement wrap to about 128 KB, while the viewer keeps the announced dimensions as its logical canvas. Later pixel writes use a 32-bit, unchecked offset calculation; a large y value overflows the product and sign-extends it, so the write lands at an attacker-chosen positive or negative offset from the undersized heap buffer.

There are two pre-authentication exposure scenarios. In Listening Mode (tvnviewer.exe -listen) the viewer binds 0.0.0.0:5500 with no password or IP restriction, so the bug is reachable directly from the network. In the outbound scenario, a user connects the viewer to an attacker-controlled or spoofed VNC server and exploitation occurs before any password prompt, because RFB authentication is one-directional: servers challenge viewers and viewers never challenge servers.

The public proof-of-concept has three stages. Stage 1 poisons BufferedOutputStream::m_dataLength to leak roughly 100 KB of adjacent heap, recovering the image base (ASLR bypass) and the framebuffer location. Stage 2 builds a fake object and a ROP chain inside the 128 KB framebuffer at a controlled offset. Stage 3 overwrites the BufferedOutputStream vtable pointer so the next virtual call pivots the stack into the ROP chain, which ultimately invokes CreateProcessW. Code runs with the privileges of the user who launched the viewer.

Per SSD, the vendor never answered the report and patched the issue on 3 October 2026 without a security notice. Secondary reporting dates the fixes as 2.8.89 (2 October 2026) and 2.8.90 (5 October 2026, also patching the Tight decoder), with the 4.0.x branch (4.0.2, 28 October 2026) as an alternative. No CVE was assigned, so vulnerability scanners and fleet-management tooling are unlikely to flag vulnerable installs. The sources do not report in-the-wild exploitation; severity HIGH is analyst-assigned because no CVSS score was published. No network IOCs are published, so no BeaconBeagle correlation applied.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1106 Native API
- T1021.005 VNC

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Shell, Script Host or LOLBin Launched by TightVNC Viewer - Post-Exploitation** (`TL-2026-5029-SPL-002`)

TL-2026-5029: detects tvnviewer.exe launching a command interpreter, script host or common living-off-the-land binary (cmd, PowerShell, wscript, mshta, rundll32, certutil, bitsadmin and similar). After the ROP chain calls CreateProcessW, attackers typically start a shell or downloader running with the privileges of the user who ran the viewer.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1203, T1059, T1059.001, T1059.003
- **Data sources:** sysmon, microsoft_defender_for_endpoint
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ParentImage="*tvnviewer.exe" Image IN ("*cmd.exe","*powershell.exe","*pwsh.exe","*wscript.exe","*cscript.exe","*mshta.exe","*rundll32.exe","*regsvr32.exe","*certutil.exe","*bitsadmin.exe","*curl.exe","*msiexec.exe","*schtasks.exe","*wmic.exe")
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as child_image values(CommandLine) as child_cmdline by host User ParentCommandLine
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| table host User ParentCommandLine child_image child_cmdline count first_seen last_seen
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "tvnviewer.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "msiexec.exe", "schtasks.exe", "wmic.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: Shell or LOLBin Spawned by TightVNC Viewer
id: 8d2e4f60-1a7b-4c35-b9e8-3c5a6d7f0b04
status: experimental
description: Detects tvnviewer.exe launching a command interpreter, script host or living-off-the-land binary, the expected post-exploitation step after the TightVNC Viewer pre-auth RCE ROP chain reaches CreateProcessW.
references:
  - https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
  - attack.t1059.001
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\tvnviewer.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\msiexec.exe'
      - '\schtasks.exe'
      - '\wmic.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Unlikely; the viewer does not normally launch interpreters or LOLBins
level: critical
```

**Known false positives:**

- Administrators who deliberately launch a command prompt from the viewer through a custom wrapper
- Endpoint management agents that run cmd.exe or msiexec.exe from a process tree rooted at tvnviewer.exe during upgrades

**Tuning notes:** Treat as a high-fidelity alert and isolate the host first. If msiexec.exe from an upgrade workflow is noisy, scope that exclusion to the exact command line of your deployment package.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Vulnerable TightVNC Viewer 2.8.88 Executed - Exposure Inventory (locked: unlock with TL Creds)
- Recon, Encoded or Download-Cradle Command Lines Spawned by TightVNC Viewer (locked: unlock with TL Creds)
- TightVNC Viewer Connecting Out to Public VNC Server - Rogue RFB Server Exposure (locked: unlock with TL Creds)
- TightVNC Viewer Started in Listening Mode ([indicator] -listen) (locked: unlock with TL Creds)
- Executable or Script Written to Disk by TightVNC Viewer (locked: unlock with TL Creds)
- Inbound TCP/5500 Connection Accepted by TightVNC Viewer (Listening Mode) (locked: unlock with TL Creds)
- TightVNC Viewer ([indicator]) Spawning Child Process - Pre-Auth RCE Outcome (locked: unlock with TL Creds)
- TightVNC Viewer or Its Children Connecting Out to Public IPs Beyond RFB - Post-Exploitation C2 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [TightVNC Viewer Pre-auth RCE - SSD Secure Disclosure](https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/)
- [TightVNC Pre-Auth RCE Vulnerability Lets Hackers Execute Code on Windows PCs, PoC Released](https://cybersecuritynews.com/tightvnc-pre-auth-rce-vulnerability/)
- [TightVNC Viewer RCE Flaw 2.8.88 (No CVE)](https://pasqualepillitteri.it/en/news/28103/tightvnc-viewer-rce-flaw-2-8-88-no-cve)
- [TightVNC Viewer Vulnerability: Integer Overflow Enables Server-Controlled Out-of-Bounds Write, Patch Released - DEV Community](https://dev.to/kserude/tightvnc-viewer-vulnerability-integer-overflow-enables-server-controlled-out-of-bounds-write-98h)
- [TightVNC Download (2.8.90 supported, 4.0.2 current)](https://www.tightvnc.com/download.php)
- [TightVNC: What's New in TightVNC](https://www.tightvnc.com/whatsnew.php)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5029