TightVNC Viewer vulnerability allows remote code execution

A pre-authentication remote code execution (RCE) vulnerability has been discovered in the TightVNC Viewer 2.8.88 x64 for Windows. The flaw allows an attacker to execute code on a user's PC before a password prompt even appears.

Research by SeongJoon Cho of SSD Labs Korea reveals that the vulnerability stems from an integer truncation error during the calculation of the framebuffer size. When a malicious VNC server announces large screen dimensions via the Remote Framebuffer protocol, TightVNC calculates the required memory using 64-bit arithmetic but truncates the result into a 32-bit integer. This leads to a much smaller memory allocation than required. Subsequent screen updates then write data outside the allocated buffer, causing memory corruption.

Attackers can exploit this by using a malicious VNC server to send specific screen data or by tricking a user into connecting the viewer to an attacker-controlled server. A proof-of-concept exploit has been released that uses return-oriented programming to launch processes via the Windows CreateProcessW function. Users are advised to update to version 2.8.90 to mitigate the risk.