TightVNC Pre-Auth RCE Vulnerability Lets Hackers Execute Code on Windows PCs, PoC Released

A TightVNC Viewer vulnerability can let attackers execute code on Windows PCs before a password prompt appears. Research credited to SeongJoon Cho of SSD Labs Korea includes proof-of-concept exploit code targeting TightVNC 2.8.88 x64. The attack uses a malicious VNC server to send screen data that corrupts the viewer’s memory.

The affected component is the viewer, not simply any Windows machine running a TightVNC server. Attackers need either network access to a viewer in Listening Mode or a user who connects the viewer to an attacker-controlled server. The supplied disclosure does not establish active exploitation.

The flaw begins when the server announces its screen size through the Remote Framebuffer protocol (RFB). TightVNC calculates the memory needed to hold that screen, but converts the result into a 32-bit integer. Large dimensions cause the value to wrap around, leaving a smaller allocation than expected.

In the reported example, a server announces a 32,768-by-32,769 screen using 32 bits per pixel. The viewer allocates only 128 KB while retaining dimensions representing more than 4 GB of pixel data. Later screen updates write outside that small buffer because the pointer calculation lacks a check against the allocated size.

TightVNC Pre-Auth RCE Vulnerability

The PoC turns this memory corruption into code execution. It first changes an outgoing buffer’s length to leak nearby memory, revealing addresses needed to bypass address randomization.

It then redirects a function call and uses return-oriented programming, which reuses existing code, to launch a process through Windows’ CreateProcessW function.

Listening Mode exposes the viewer on TCP port 5500 and, according to the disclosure, accepts incoming server connections without a password or IP restriction.

An attacker who can reach that port can target the viewer directly. An outbound connection to a rogue support server creates another route, with exploitation occurring before authentication.

These conditions differ from VNC connection hijacking that relies on weak passwords. They also differ from remote access tools disguised as installers, where users install legitimate software under pretenses. Here, the attack targets memory handling inside the viewer itself.

The researchers say the vendor did not respond and patched the issue on October 3, 2026. However, TightVNC’s official release notices identify October 2 and October 5 security updates, so the exact fix date remains unclear. The vendor says versions 2.8.89 and 2.8.90 address Viewer security issues and recommends 2.8.90 for that branch.

Administrators should update affected viewers, turn off unnecessary Listening Mode, restrict port 5500 to trusted systems, and avoid untrusted VNC servers. Network restrictions reduce exposure but do not replace patching the vulnerable viewer.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.