CVE-2026-107614 in TightVNC
Summary
by MITRE • 10/08/2026
An integer underflow in WinCursorShapeUtils::trimTransparent() in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to crash the server, and potentially read out-of-bounds memory, by causing a cursor shape with a width or height of zero to be processed on the DXGI capture path. The loop bound width - 1 wraps to 0xFFFFFFFF, producing an access roughly 4 GB beyond the 64 KB cursor buffer; a monochrome cursor of height 1 also becomes 0 because getCursorHeight() halves the height in place.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified as CVE-2023-XXXXX resides within the WinCursorShapeUtils::trimTransparent function of GlavSoft TightVNC Server for Windows, specifically affecting versions prior to 2.8.88. This flaw represents a critical integer underflow condition that arises during the processing of cursor shapes on the DirectX Graphics Infrastructure DXGI capture path. The root cause is rooted in improper handling of arithmetic operations involving unsigned integers when calculating loop bounds and buffer dimensions. Specifically, when a maliciously crafted or malformed cursor shape with a width or height of zero is processed, the function attempts to calculate a loop bound by subtracting one from the dimension value. Because these values are treated as unsigned types, subtracting one from zero causes an arithmetic wrap-around, resulting in the maximum possible value for that data type, which is 0xFFFFFFFF on a 32-bit system or equivalent large positive integer on larger architectures. This erroneous calculation fundamentally breaks the bounds checking logic intended to protect memory access operations within the cursor buffer management subsystem.
The operational impact of this vulnerability extends beyond simple service disruption due to the nature of the resulting memory access patterns. The miscalculated loop bound causes the application to iterate far beyond the allocated boundaries of the 64 KB cursor buffer, effectively accessing approximately four gigabytes of adjacent virtual address space. This out-of-bounds read operation can lead to two distinct adverse outcomes depending on the state of the surrounding memory pages. In many scenarios, the access will hit unmapped or protected memory regions, triggering an immediate exception that crashes the TightVNC server process and denies service to legitimate remote desktop users. However, in more sophisticated exploitation contexts where adjacent memory is mapped and readable, this flaw allows for arbitrary information disclosure. An attacker could potentially read sensitive data residing in neighboring buffers, such as cryptographic keys, session tokens, or other user credentials stored within the application's address space, thereby compromising confidentiality requirements.
From a classification perspective, this vulnerability aligns with CWE-190 Integer Overflow or Wraparound and CWE-787 Out-of-bounds Read. The exploitation vector is classified under MITRE ATT&CK technique T1203 Exploitation for Client Execution if the cursor shape can be triggered via client interaction, though in this specific server-side processing context, it primarily facilitates local privilege escalation through information disclosure or denial of service by a user who already has authenticated access to the system. The requirement for an authenticated local user limits the attack surface compared to remote code execution vulnerabilities but remains significant because many VNC deployments operate with elevated privileges or where lateral movement is facilitated by credential theft via memory scraping.
Mitigation strategies must prioritize immediate patching of the TightVNC Server installation to version 2.8.88 or later, which contains the necessary fixes for this integer underflow condition. For environments where upgrading is not immediately feasible, administrative controls should be implemented to restrict local user access to systems running vulnerable versions of the software. Additionally, deploying endpoint detection and response solutions that monitor for abnormal memory access patterns or process crashes in VNC-related binaries can provide early warning indicators of exploitation attempts. Developers reviewing similar code paths should enforce strict validation of input dimensions before performing arithmetic operations on unsigned integers, ensuring that subtractions do not result in wrap-around values by checking if the operand is less than one prior to subtraction.