Cyberattacks | Vulnerabilities

TightVNC Viewer Flaw Runs Attacker Code Ahead of VNC Login

A malicious remote-desktop server can run code on a Windows PC during the connection handshake, and a working exploit is public. Fixes are out.

By Content Team

Nov 2, 2026

ON THIS PAGE

A pre-authentication flaw in TightVNC Viewer lets a malicious VNC server execute code on a Windows PC during connection setup, before the viewer ever reaches a password check. SeongJoon Cho of SSD Labs Korea found the bug, and SSD Secure Disclosure published proof-of-concept exploit code on October 29, 2026, tested against version 2.8.88 x64. TightVNC Server isn’t affected.

The viewer stores the remote screen’s memory size in a 32-bit integer, so an oversized screen gets a buffer far too small, and later screen updates overwrite neighboring memory. Attackers get in two ways: a user connects to their server, or a viewer sits in Listening Mode on TCP port 5500, where any server can connect.

TightVNC 2.8.89 and 2.8.90 fix the flaw, and the vendor recommends 2.8.90. Install it wherever the viewer runs. Until then, keep Listening Mode off unless a session needs it, firewall port 5500 from untrusted networks, and connect only to VNC servers you know.

Source: Cybersecurity News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?