What this actually is.
Technical background, root cause, and affected surface.
DynamicLibrary::init() (and ThemeLib) call LoadLibrary() with the bare file names screenhooks32.dll / screenhooks64.dll and no LOAD_LIBRARY_SEARCH_* flags. The SYSTEM service therefore follows the default DLL search order and will load an attacker-planted DLL from a writable directory earlier in that order, such as an installation directory with permissive ACLs.
- Product
- TightVNC
- Vendor
- GlavSoft LLC
- Severity
- High
- CVSS Score
- 7.8
- Status
- Published
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-427: Uncontrolled Search Path Element
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
Working PoC developed by Securin and shared privately with the vendor; no public PoC released.
The bug, and the fix.
DynamicLibrary.cpp:49 - LoadLibrary(filename) with bare name, no full path, no LOAD_LIBRARY_SEARCH_* flags (no safe flags anywhere in the codebase) ThemeLib.cpp - same pattern
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Arbitrary code execution with SYSTEM privileges
C:H · I:H · A:H
CWE-427: Uncontrolled Search Path Element
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade TightVNC to 2.8.88 or later, which loads screen hook libraries only from the installation or Windows system directory. Ensure the installation directory is writable only by administrators.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Reported to vendor (SourceForge #1666)
Vendor acknowledged
TightVNC 2.8.88 released with fix
CVE published to MITRE
Disclosed 20 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.