Upcoming Advisory — sec-zd-317

01/Description

What this actually is.

Technical background, root cause, and affected surface.

Win8ScreenDriver::applyNewScreenProperties() resets m_drvImpl to NULL before constructing a new DXGI implementation. If the constructor throws (GPU reset, display hot-plug, RDP/session change, hybrid-GPU switch), m_drvImpl stays NULL and is later dereferenced without checks by executeDetection(), getScreenBuffer(), grabFb(), getScreenPropertiesChanged() and getCursorPosition(), crashing the server.

Product: TightVNC
Vendor: GlavSoft LLC
Severity: Medium
CVSS Score: 5.9
Status: Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-476: NULL Pointer Dereference

02/Proof of Concept

From one request
to root shell.

Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.

VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

ScopeUnchanged

ImpactC:N / I:N / A:H

SeverityMedium

Working PoC developed by Securin and shared privately with the vendor; no public PoC released.

03/Vulnerable Code

The bug, and the fix.

Win8ScreenDriver.cpp:100-136 applyNewScreenProperties() - m_drvImpl set to 0 then constructor throws Win8ScreenDriver.cpp:58/79/85/91/135 - executeDetection(), getScreenBuffer(), grabFb(), getScreenPropertiesChanged(), getCursorPosition() dereference m_drvImpl without NULL check (header states it 'must be always guaranteed non zero')

04/Impact

What an attacker does to you.

Post-exploitation outcomes mapped to CVSS impact metrics.

Medium

TightVNC Server crash and loss of all active remote sessions (denial of service)

CIA Impact

C:N · I:N · A:H

CWE-476: NULL Pointer Dereference

05/Remediation

Fix it. In this order.

A runbook, not a checklist. Sequence matters — assume compromise before you act.

Upgrade TightVNC to 2.8.88 or later, which adds internal state checks during screen capture. Configure service recovery to restart the server automatically.

N/A

Securin advisory — For coordinated remediation support or threat-actor briefings related to CVE-2026-107613, contact disclose@securin.io

06/Disclosure Timeline

Vendors moved in days.
Attackers in hours.

Reconstructed from vendor advisories, CISA bulletins, and Securin research records.

2026-05-30

Reported to vendor (SourceForge #1660)

2026-06-02

Vendor acknowledged

2026-06-19

TightVNC 2.8.88 released with fix

2026-10-08

CVE published to MITRE

Disclosed 20 days after discovery

07/References

Cite, verify, go deeper.

Primary sources — NVD, CISA KEV, and machine-readable IoC feed.

NVD

NVD — CVE-2026-107613

nvd.nist.gov/vuln/detail/CVE-2026-107613 →

SEC

Securin VI — Full Technical Analysis

vi.securin.io →

CVE

https://www.cve.org/CVERecord?id=CVE-2026-107613

https://www.cve.org/CVERecord?id=CVE-2026-107613 →

SOURCE

https://sourceforge.net/p/vnc-tight/bugs/1660/

https://sourceforge.net/p/vnc-tight/bugs/1660/ →

TIGHTV

https://www.tightvnc.com/whatsnew.php

https://www.tightvnc.com/whatsnew.php →

NULL pointer dereference in TightVNC Server Win8ScreenDriver after failed DXGI re-initialization

What this actually is.

From one request
to root shell.

The bug, and the fix.

What an attacker does to you.

TightVNC Server crash and loss of all active remote sessions (denial of service)

C:N · I:N · A:H

Fix it. In this order.

Upgrade TightVNC to 2.8.88 or later, which adds internal state checks during screen capture. Configure service recovery to restart the server automatically.

Vendors moved in days.
Attackers in hours.

Reported to vendor (SourceForge #1660)

Vendor acknowledged

TightVNC 2.8.88 released with fix

CVE published to MITRE

Cite, verify, go deeper.

NVD — CVE-2026-107613

Securin VI — Full Technical Analysis

https://www.cve.org/CVERecord?id=CVE-2026-107613

https://sourceforge.net/p/vnc-tight/bugs/1660/

https://www.tightvnc.com/whatsnew.php

Let Securin level up your security posture.

NULL pointer dereference in TightVNC Server Win8ScreenDriver after failed DXGI re-initialization

What this actually is.

From one requestto root shell.

The bug, and the fix.

What an attacker does to you.

TightVNC Server crash and loss of all active remote sessions (denial of service)

C:N · I:N · A:H

Fix it. In this order.

Upgrade TightVNC to 2.8.88 or later, which adds internal state checks during screen capture. Configure service recovery to restart the server automatically.

Vendors moved in days.Attackers in hours.

Reported to vendor (SourceForge #1660)

Vendor acknowledged

TightVNC 2.8.88 released with fix

CVE published to MITRE

Cite, verify, go deeper.

NVD — CVE-2026-107613

Securin VI — Full Technical Analysis

https://www.cve.org/CVERecord?id=CVE-2026-107613

https://sourceforge.net/p/vnc-tight/bugs/1660/

https://www.tightvnc.com/whatsnew.php

Let Securin level up your security posture.

From one request
to root shell.

Vendors moved in days.
Attackers in hours.