# TightVNC, UltraVNC Viewers Hit by Heap Overflow

Published: 2026-11-13 · Severity: routine
Canonical: https://vorant.io/reports/526f6975-369c-5656-969b-dc1686e229b5/tightvnc-ultravnc-viewers-hit-by-heap-overflow
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> A heap-based buffer overflow in TightVNC and UltraVNC Windows viewers' JPEG decoding lets a malicious VNC server crash or possibly code-execute on connecting clients.

Source: kb.cert.org — https://kb.cert.org/vuls/id/644655

## What to check

- Applies to: The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT/CC disclosed a heap-based buffer overflow (CVE-2026-128321) in the Tight JPEG decoding routine of TightVNC's Windows Viewer version 1.3.10 and affected UltraVNC Windows Viewers. The flaw resides in the DecompressJpegRect() function, which allocates a heap buffer based on a hardcoded maximum row width of 8,192 pixels but fails to validate that server-supplied JPEG rectangle data actually fits within that buffer during conversion. A malicious or compromised VNC server can send an oversized Tight JPEG rectangle (testing showed the overflow beginning at a width of 8,257 pixels with 256 bytes of padding) to corrupt heap memory in the connecting viewer.

Exploitation requires only that a vulnerable viewer connect to an attacker-controlled server and process a crafted screen update; authentication and transport encryption do not prevent it, and a malicious server can simply advertise a large enough framebuffer to defeat naive bounds checks. During testing only denial-of-service (application crash) was confirmed, though the researchers note memory corruption could potentially allow arbitrary code execution with the privileges of the user running the viewer. No in-the-wild exploitation has been reported.

UltraVNC addressed the issue in version 1.8.2.8, and users should upgrade to a current release such as 1.8.3.1. CERT/CC was unable to reach the TightVNC project to coordinate a fix for the affected 1.3.10 Windows viewer, so TightVNC users should migrate to a maintained alternative. Until patched, defenders should restrict VNC viewer connections to trusted, known-good servers only — noting this mitigation does not protect against a trusted server that has itself been compromised.

## Mentioned in this report

- Vulnerabilities: CVE-2026-128321

## Detection guidance (public sample)

### VNC Viewer Outbound Connection to Non-Private Address

ATT&CK: T1219

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs windows network_connection logs. Status: experimental. Generated from the report; not run against telemetry.

TightVNC or UltraVNC Windows viewer connecting to a public IP on a VNC port. This is the precondition for the Tight JPEG heap overflow, which needs a malicious or compromised server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: VNC Viewer Outbound Connection to Non-Private Address
description: Detects TightVNC or UltraVNC Windows viewers initiating a connection
  to a non-private, non-multicast address on a standard VNC port. The reported heap
  overflow in the Tight JPEG decoder (DecompressJpegRect) is triggered only when a
  vulnerable viewer connects to an attacker-controlled or compromised server, so connections
  outside trusted ranges are the exposure to review.
tags:
- attack.initial-access
- attack.t1219
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    Image|endswith:
    - \tvnviewer.exe
    - \vncviewer.exe
    DestinationPort:
    - 5900
    - 5901
    - 5902
    - 5903
    - 5904
    - 5905
    - 5906
    - 5907
    - 5908
    - 5909
  filter_internal:
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 127.0.0.0/8
    - 169.254.0.0/16
    - 224.0.0.0/4
    - ::1/128
    - fe80::/10
    - fc00::/7
    - ff00::/8
  condition: selection and not filter_internal
falsepositives:
- Administrators using a VNC viewer to reach legitimate remote or cloud-hosted systems
- Helpdesk staff supporting remote users through a known VNC relay
level: medium
id: 580460e3-0dd1-5370-a614-274d96e1c9a8
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/644655
```

### VNC Viewer Application Crash

ATT&CK: T1219

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs windows application logs. Status: experimental. Generated from the report; not run against telemetry.

Application Error event for a TightVNC or UltraVNC viewer, a possible sign of the Tight JPEG heap overflow denial-of-service from a malicious server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: VNC Viewer Application Crash
description: Detects Application Error (event 1000) crashes of TightVNC or UltraVNC
  Windows viewers. The reported Tight JPEG heap overflow only confirmed denial-of-service
  (a viewer crash) when connecting to a malicious server. Correlate with recent viewer
  connections to untrusted hosts.
tags:
- attack.impact
- attack.t1499.004
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name: Application Error
    EventID: 1000
  selection_app:
    Data|contains:
    - tvnviewer.exe
    - vncviewer.exe
  condition: selection and selection_app
falsepositives:
- Ordinary viewer instability or crashes caused by display or driver issues
- Viewer crashes after a network drop during a legitimate session
level: low
id: 913c3fd7-52c1-531b-8cf0-f008052616fe
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/644655
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/644655

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/526f6975-369c-5656-969b-dc1686e229b5/tightvnc-ultravnc-viewers-hit-by-heap-overflow.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup