CVE-2026-107612 in TightVNC
Summary
by MITRE • 10/08/2026
Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communication handles used between the TightVNC service and its desktop server process. The named shared memory segment in the Global\ namespace that carries the pipe HANDLE values is created with a NULL DACL, and its name is derived from a time-seeded srand(time(0)) value that is predictable to one-second granularity. A low-privileged local process can open the mapping and tamper with the IPC channel of a service running as SYSTEM, potentially leading to disclosure of session data, privilege escalation, or denial of service.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in GlavSoft TightVNC Server for Windows prior to version 2.8.88 represents a critical failure in access control mechanisms governing inter-process communication within the operating system environment. This flaw specifically affects the security context where the TightVNC service, which typically operates with high-level SYSTEM privileges, communicates with its associated desktop server process. The core technical deficiency lies in the creation of a named shared memory segment located in the Global namespace, which is responsible for carrying pipe handle values necessary for this communication channel. Instead of applying restrictive access control lists to ensure that only authorized processes can interact with this resource, the software creates the mapping object using a NULL Discretionary Access Control List. In Windows security architecture, a NULL DACL implies that all users and groups are granted full read-write permissions by default unless explicitly restricted by other system-wide policies, which is often not the case for such sensitive IPC mechanisms.
The predictability of this vulnerability further exacerbates its severity beyond standard improper permission assignment issues. The name used to identify the shared memory segment in the Global namespace is generated using a pseudo-random number generator seeded with the current time via srand(time(0)). Because the system clock operates at one-second granularity, an attacker can easily brute-force or predict the exact name of the shared memory object being created by the TightVNC service. This temporal predictability allows any local authenticated user to locate and open the specific mapping object without needing prior knowledge of unique identifiers that would otherwise protect against such enumeration attacks. Consequently, a low-privileged process running on the same machine can directly access the inter-process communication channel intended for privileged operations.
The operational impact of this flaw is significant due to the elevation in privilege context involved. Since the TightVNC service runs as SYSTEM, any tampering with its IPC handles by a lower-privileged user effectively allows that user to manipulate processes running at the highest level of trust on the Windows operating system. An attacker can exploit this access to read sensitive session data, potentially capturing keystrokes or screen contents from active VNC sessions. More critically, the ability to overwrite handle values enables privilege escalation attacks where an attacker can redirect commands or inject malicious code into the SYSTEM-level process. This could result in complete compromise of the host machine, allowing for persistent backdoors, installation of malware with elevated privileges, or execution of arbitrary code under the context of the system account. Additionally, denial of service is a viable outcome if the IPC channel is corrupted or closed improperly by an unprivileged user, disrupting remote administration capabilities and potentially causing instability in dependent services.
From a classification perspective, this vulnerability aligns closely with CWE-276, which denotes Incorrect Default Permissions, as the software fails to set appropriate security descriptors on newly created objects. It also relates to CWE-358 regarding Improperly Secured Data Structure, given that the shared memory segment is not adequately protected against unauthorized modification. In terms of offensive tactics, this scenario maps directly to MITRE ATT&CK technique T1055, specifically Process Injection or Access Token Manipulation variants where an attacker leverages weak IPC security to interact with high-privilege processes. It also touches upon T1047, Windows Management Instrumentation, if the manipulation leads to broader system control through service interaction.
Mitigation strategies must prioritize immediate patching of the TightVNC Server software to version 2.8.88 or later, where these permission assignments have been corrected to enforce strict access controls on the shared memory segments. Until patches are applied, administrators should consider restricting local user privileges that allow for opening objects in the Global namespace if feasible within their security policy framework. Furthermore, implementing mandatory integrity control levels and auditing object manager activities can help detect attempts to interact with these IPC handles. Regular review of service configurations and ensuring that services do not rely on predictable naming conventions for critical communication channels are essential best practices to prevent similar vulnerabilities in other applications.