TightVNC, UltraVNC Viewers Hit by Heap Overflow
A heap-based buffer overflow in TightVNC and UltraVNC Windows viewers' JPEG decoding lets a malicious VNC server crash or possibly code-execute on connecting clients.
Sourcekb.cert.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT/CC disclosed a heap-based buffer overflow (CVE-2026-128321) in the Tight JPEG decoding routine of TightVNC's Windows Viewer version 1.3.10 and affected UltraVNC Windows Viewers. The flaw resides in the DecompressJpegRect() function, which allocates a heap buffer based on a hardcoded maximum row width of 8,192 pixels but fails to validate that server-supplied JPEG rectangle data actually fits within that buffer during conversion. A malicious or compromised VNC server can send an oversized Tight JPEG rectangle (testing showed the overflow beginning at a width of 8,257 pixels with 256 bytes of padding) to corrupt heap memory in the connecting viewer.
Exploitation requires only that a vulnerable viewer connect to an attacker-controlled server and process a crafted screen update; authentication and transport encryption do not prevent it, and a malicious server can simply advertise a large enough framebuffer to defeat naive bounds checks. During testing only denial-of-service (application crash) was confirmed, though the researchers note memory corruption could potentially allow arbitrary code execution with the privileges of the user running the viewer. No in-the-wild exploitation has been reported.
UltraVNC addressed the issue in version 1.8.2.8, and users should upgrade to a current release such as 1.8.3.1. CERT/CC was unable to reach the TightVNC project to coordinate a fix for the affected 1.3.10 Windows viewer, so TightVNC users should migrate to a maintained alternative. Until patched, defenders should restrict VNC viewer connections to trusted, known-good servers only — noting this mitigation does not protect against a trusted server that has itself been compromised.
Mentioned in this report
Detection guidance
VNC Viewer Outbound Connection to Non-Private Address
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
TightVNC or UltraVNC Windows viewer connecting to a public IP on a VNC port. This is the precondition for the Tight JPEG heap overflow, which needs a malicious or compromised server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: VNC Viewer Outbound Connection to Non-Private Address
description: Detects TightVNC or UltraVNC Windows viewers initiating a connection
to a non-private, non-multicast address on a standard VNC port. The reported heap
overflow in the Tight JPEG decoder (DecompressJpegRect) is triggered only when a
vulnerable viewer connects to an attacker-controlled or compromised server, so connections
outside trusted ranges are the exposure to review.
tags:
- attack.initial-access
- attack.t1219
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
Image|endswith:
- \tvnviewer.exe
- \vncviewer.exe
DestinationPort:
- 5900
- 5901
- 5902
- 5903
- 5904
- 5905
- 5906
- 5907
- 5908
- 5909
filter_internal:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
- 169.254.0.0/16
- 224.0.0.0/4
- ::1/128
- fe80::/10
- fc00::/7
- ff00::/8
condition: selection and not filter_internal
falsepositives:
- Administrators using a VNC viewer to reach legitimate remote or cloud-hosted systems
- Helpdesk staff supporting remote users through a known VNC relay
level: medium
id: 580460e3-0dd1-5370-a614-274d96e1c9a8
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/644655
VNC Viewer Application Crash
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Application Error event for a TightVNC or UltraVNC viewer, a possible sign of the Tight JPEG heap overflow denial-of-service from a malicious server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: VNC Viewer Application Crash
description: Detects Application Error (event 1000) crashes of TightVNC or UltraVNC
Windows viewers. The reported Tight JPEG heap overflow only confirmed denial-of-service
(a viewer crash) when connecting to a malicious server. Correlate with recent viewer
connections to untrusted hosts.
tags:
- attack.impact
- attack.t1499.004
logsource:
product: windows
service: application
detection:
selection:
Provider_Name: Application Error
EventID: 1000
selection_app:
Data|contains:
- tvnviewer.exe
- vncviewer.exe
condition: selection and selection_app
falsepositives:
- Ordinary viewer instability or crashes caused by display or driver issues
- Viewer crashes after a network drop during a legitimate session
level: low
id: 913c3fd7-52c1-531b-8cf0-f008052616fe
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/644655
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/644655
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs