TightVNC and UltraVNC Viewer CVE-2026-128321: Heap Overflow Caused by Malicious Server

1. Basic Information

• Article Name: TightVNC and UltraVNC Viewer contains a heap-based buffer overflow
• Source: CERT/CC
• Published Date: 2026-11-13
• Updated Date: 2026-11-13
• Collection Date: 2026-11-14T08:00:43+09:00
• Original: CERT/CC
• Related Sources: JVN: TightVNC / UltraVNC Viewer heap overflow
• Related Malware: None
• Related Attack Groups: None
• Related CVE: CVE-2026-128321
• Related Products and Technologies: TightVNC Windows Viewer 1.3.10, UltraVNC Viewer 1.8.2.4 to 1.8.2.6
• Response Priority (Author's Assessment): High
• Basis for Response Priority: An affected viewer can suffer memory corruption when it connects to a malicious or compromised VNC server and processes a crafted Tight JPEG update. CERT/CC reports that testing demonstrated DoS; code execution remains unconfirmed, and product-specific test details and the testing parties are not specified.

2. Quick Summary

CERT/CC reported that TightVNC Windows Viewer 1.3.10 and affected UltraVNC Viewer versions (1.8.2.4 to 1.8.2.6) use a fixed 8192-pixel row buffer for the specified server width, causing a heap out-of-bounds write when processing crafted Tight JPEG rectangles.

3. Attack Flow

TightVNC Viewer Overflow from Malicious VNC Server

1. An attacker operates a VNC server or compromises a legitimate server.
2. The user is induced to connect to the server.
3. The server sends a Tight JPEG rectangle with a width exceeding 8192 pixels.
4. An out-of-bounds write occurs in the TightVNC Viewer heap, leading to heap corruption and potential DoS. Code execution is unconfirmed.

UltraVNC Viewer Overflow from Malicious VNC Server

1. An attacker operates a VNC server or compromises a legitimate server.
2. The user is induced to connect to the server.
3. The server sends a Tight JPEG rectangle with a width exceeding 8192 pixels.
4. An out-of-bounds write occurs in the UltraVNC Viewer heap, leading to heap corruption and potential DoS. Code execution is unconfirmed.

The two products share the same underlying mechanism, but product-specific test outcomes should not be inferred where the source does not provide them.

4. Attacker Position and Execution Location

• A remote attacker who can control the VNC server connected to by the user's viewer.

5. Visibility for Victims and Administrators

Victim Side

• The viewer may crash when processing crafted updates.

Administrator Side

• Visible as VNC sessions, viewer crash dumps, heap corruption, and connection destination servers.

6. Success and Failure Conditions

Success Conditions

• Using an affected viewer.
• Connecting to a malicious server.
• Processing a crafted Tight JPEG encoding.

Failure Conditions and Mitigations

• Update UltraVNC to 1.8.2.8 or later.
• Replace unpatched TightVNC viewers.
• Implement temporary mitigations to block connections to unauthorized servers. This is ineffective against the compromise of authorized servers.

7. What Happens Upon Success

• Viewer DoS.
• Potential code execution under viewer process privileges, though unproven.

8. Observable Logs

• Email: None specified
• Proxy/SWG/DNS: Network sensors or EDR should be used as VNC is typically outside proxies.
• Endpoint/EDR: Viewer crash, heap corruption.
• Identity/IdP: None specified
• SaaS/Cloud: None specified
• Network: Tight JPEG rectangles with abnormal widths. Requires retrieval, decryption, and parsing of RFB contents; flow logs alone cannot verify rectangle widths.

9. Attack Success Assessment

TightVNC: Potential DoS, Code Execution Unconfirmed

• Public Information: Initial execution is unconfirmed. CERT/CC data reports that only DoS was confirmed during testing. Product-specific test details and testing entities are not specified. RCE remains unproven.
• Verification Scope: Controlled validation.

UltraVNC: Potential DoS, Code Execution Unconfirmed

• Public Information: Initial execution is unconfirmed. CERT/CC data reports that only DoS was confirmed during testing. Product-specific test details and testing entities are not specified. RCE remains unproven.
• Verification Scope: Controlled validation.

Fixed labels represent evaluation perspectives and do not indicate confirmed initial execution records. Product-specific verification results are not supplemented where data is absent.

10. Investigation Playbook

• Trigger: VNC viewer crash, connection to an unknown server.
• Initial Checks: Verify viewer version, server, connection inducement path, and crash time.
• Endpoint: Preserve crash dumps, process memory, and binary hashes. Preserve child processes if code execution is suspected.
• Identity/Cloud: Check the use of support accounts and administrative credentials.
• Follow-on: Identify other endpoints that connected to the same server.
• Containment: Update or replace the viewer, block the server, and perform credential rotation if necessary.
• Classification: Distinguish between crash only, memory corruption, and code execution.

11. Defense and Detection Ideas

• Single Event: Viewer access violation and heap corruption.
• Time Series: Correlate unknown VNC server connection -> crafted rectangle -> crash.
• Hunting: Search all endpoints for connections to the same server and viewer versions.
• Logging Gaps: Combine flow and crash dumps if RFB protocol decoding is unavailable.
• Priority Controls: Prioritize viewer updates, connection allowlists, and isolation of management terminals.

12. Facts, Inference, and Hypothesis

Facts

• The viewer allocates a fixed 8192-pixel buffer for Tight JPEG rows.
• If the server specifies a width exceeding this, an out-of-bounds write occurs; in specific test allocations (including a 256-byte padding), overflow began at 8257 pixels.
• CERT/CC data reports that only DoS was confirmed during testing. Product-specific test details and testing entities are not specified. RCE was suggested as a possibility but not proven.
• UltraVNC addressed this in version 1.8.2.8, and CERT/CC cites 1.8.3.1 as an example of a supported version containing the fix.
• CERT/CC reports that it could not contact TightVNC to coordinate a fix for the affected 1.3.10 Windows viewer and recommends replacing affected viewers.

Inference

• Combined with social engineering to lure support staff to an attacker-controlled VNC server, management terminals become targets.
• If code execution is suspected, check for the presence of child processes as an unobserved investigation candidate.

Hypothesis

• No additional hypotheses

13. MITRE ATT&CK Mapping

No specific mappings available.

14. Unknowns and Further Investigation

• The official fix timing for TightVNC, RCE exploitability, and the impact range of other forks remain unconfirmed.

15. Impact on SOCs and Organizations

Update or replace remote support viewers. As a temporary mitigation, allow connections only to trusted VNC servers. Also isolate management endpoints from general web browsing environments. The connection restriction does not protect against a compromised trusted server.

16. Summary by Target Audience

• For SOCs: Monitor for VNC viewer crashes, crafted rectangles, and memory exceptions immediately following connections.
• For Administrators: Update UltraVNC to version 1.8.2.8 or later and replace unpatched TightVNC viewers.
• For Users: Do not connect carelessly to externally provided VNC destinations and verify through official support channels.