What this actually is.
Technical background, root cause, and affected surface.
The ZRLE decoder in TightVNC Viewer does not validate palette indices before using them to look up colours. A server that declares a small palette (for example 2 entries) but sends run-length or packed-palette pixels referencing a larger index causes the viewer to read past the end of the palette heap allocation. The out-of-bounds bytes are copied into the framebuffer (garbled display / heap disclosure on screen) or the read faults and the viewer crashes.
- Product
- TightVNC
- Vendor
- GlavSoft LLC
- Severity
- High
- CVSS Score
- 7.1
- Status
- Published
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
- CWE
- CWE-125: Out-of-bounds Read
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
Working PoC developed by Securin and shared privately with the vendor; no public PoC released.
The bug, and the fix.
ZrleDecoder.cpp:315 readPaletteRleTile() - palette index used without bounds check before memcpy (subencoding 130, paletteSize=2, colour byte 0xFF -> index 127 -> reads ~500 bytes past an 8-byte allocation) ZrleDecoder.cpp:264 readPackedPaletteTile() - packed index bitmask allows values 0-15 while palette size may be smaller
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Viewer crash (denial of service) and disclosure of adjacent viewer heap memory into the rendered framebuffer
C:L · I:N · A:H
CWE-125: Out-of-bounds Read
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade TightVNC to 2.8.88 or later, which validates ZRLE palette indices. Until upgraded, connect only to trusted VNC servers.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Reported to vendor (SourceForge #1657)
Vendor acknowledged
TightVNC 2.8.88 released with fix
CVE published to MITRE
Disclosed 20 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.