What this actually is.
Technical background, root cause, and affected surface.
WinCursorShapeUtils::trimTransparent() iterates from width - 1 down without guarding against a zero width or height. When DXGI reports a cursor dimension of 0, the unsigned expression wraps to 0xFFFFFFFF and the server reads roughly 4 GB beyond the 64 KB cursor buffer, faulting with STATUS_ACCESS_VIOLATION. getCursorHeight() additionally halves a monochrome cursor's height in place, so a height of 1 becomes 0.
- Product
- TightVNC
- Vendor
- GlavSoft LLC
- Severity
- Medium
- CVSS Score
- 6.1
- Status
- Published
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
- CWE
- CWE-191: Integer Underflow (Wrap or Wraparound), CWE-125: Out-of-bounds Read
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
Working PoC developed by Securin and shared privately with the vendor; no public PoC released.
The bug, and the fix.
WinCursorShapeUtils.cpp:168 - for (UINT x = width - 1; x > trimmedWidth; --x) with width == 0 -> 0xFFFFFFFF (offset 4294967292 in a 65536-byte buffer) WinCursorShapeUtils.cpp:256 getCursorHeight() - 'return shapeInfo.Height /= 2;' mutates caller struct via non-const reference
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
TightVNC Server crash (denial of service); potential out-of-bounds memory read
C:L · I:N · A:H
CWE-191: Integer Underflow (Wrap or Wraparound), CWE-125: Out-of-bounds Read
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade TightVNC to 2.8.88 or later, which validates cursor dimensions before processing.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Reported to vendor (SourceForge #1661)
Vendor acknowledged
TightVNC 2.8.88 released with fix
CVE published to MITRE
Disclosed 20 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.