What this actually is.
Technical background, root cause, and affected surface.
The TightVNC service passes pipe handles to its desktop-server child process through a named shared memory segment in the Global\ namespace. The segment is created with a NULL DACL, so any local user can open it, and its name is derived from srand(time(0)), making it predictable to one-second granularity. A low-privileged process can open the mapping and read or overwrite the pipe HANDLE values used by the SYSTEM service.
- Product
- TightVNC
- Vendor
- GlavSoft LLC
- Severity
- High
- CVSS Score
- 7.8
- Status
- Published
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-732: Incorrect Permission Assignment for Critical Resource, CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
Working PoC developed by Securin and shared privately with the vendor; no public PoC released.
The bug, and the fix.
SharedMemory.cpp:111 - SetSecurityInfo(..., lpDacl = NULL) on the Global\ section object DesktopServerWatcher.cpp:79-81 - section name seeded with srand(time(0)); mem[1..6] hold pipe HANDLEs
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Disclosure of session/IPC data, tampering with the SYSTEM service's IPC channel, potential privilege escalation or denial of service
C:H · I:H · A:H
CWE-732: Incorrect Permission Assignment for Critical Resource, CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade TightVNC to 2.8.88 or later (unpredictable channel names). Note: the 2.8.88 release notes describe randomised channel names; confirm the shared memory is also created with a restrictive DACL.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Reported to vendor (SourceForge #1658)
Vendor acknowledged
TightVNC 2.8.88 released with fix
CVE published to MITRE
Disclosed 20 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.