TightVNC Viewer: Pre-Auth RCE With Public Exploit, No CVE Assigned

If your help desk uses TightVNC, patch the viewer today. SSD Secure Disclosure has published a full proof-of-concept for a pre-authentication remote code execution flaw in TightVNC Viewer 2.8.88 for Windows - and despite the working exploit, the bug still has no CVE identifier.

The flaw lives in the viewer, not the server. When a VNC server announces its screen size through the Remote Framebuffer protocol, the viewer calculates the memory needed to hold that screen - but converts the result to a 32-bit integer. Large dimensions wrap the value around, leaving a far smaller allocation than needed, and the attacker's screen data corrupts the viewer's memory. SSD's exploit chains this into code execution, first leaking nearby memory to defeat address randomization. It all happens before any authentication.

Two ways in, one of them network-direct

An attacker needs one of two things: a user who connects their viewer to a malicious server (the classic rogue "support server" scenario), or network access to a viewer running in Listening Mode. That second path is the nasty one: Listening Mode binds port 5500 on all interfaces and waits for a server to connect - no IP restriction, no password, and, as SSD notes, the standard help-desk deployment. In that configuration the RCE is directly reachable on the network.

Patch timeline, and a missing CVE

Researcher SeongJoon Cho of SSD Labs Korea reports the vendor never responded to the disclosure, then quietly shipped fixes on October 3 without flagging them as security patches. TightVNC's official changelog tells the story in hindsight: version 2.8.89 "added checks for oversized framebuffers... preventing integer overflows and unsafe memory access when processing invalid data from a server," and 2.8.90 fixed "a potential buffer overrun when processing invalid Tight-encoded screen data." There is no confirmed in-the-wild exploitation - but with complete exploit code public since October 29, that's reassurance with an expiration date.

What to do

Update every TightVNC Viewer to 2.8.90 (the branch's recommended release). Turn off Listening Mode where it isn't needed, restrict port 5500 to trusted systems at the firewall, and treat unsolicited "connect to my support server" requests as hostile until proven otherwise. Network restrictions shrink the target; only patching removes it.