TightVNC Server CVE-2026-107613

Exploitation requires the affected code path to be reached after a failed re-initialization of the DXGI Desktop Duplication driver in the Win8ScreenDriver component - specifically, applyNewScreenProperties() must fail following a GPU reset, display hot-plug, or user session change, leaving m_drvImpl NULL before executeDetection(), getScreenBuffer(), grabFb(), getScreenPropertiesChanged(), or getCursorPosition() runs. Limiting factors: this is Windows-only (TightVNC Server for Windows), it affects only versions before 2.8.88, and the crash hinges on an environmental re-init failure that an attacker generally cannot command on demand - which is why the vector is rated AC:H. Impact is limited to a service crash with no confidentiality or integrity effect.

This is a moderate-severity denial-of-service issue (CVSS 5.9, A:H only, with C:N/I:N) that in practice is lower priority than its base score suggests. The CVSS vector claims a network attack vector (AV:N) with no privileges or user interaction (PR:N/UI:N) but high complexity (AC:H), and the high complexity is the decisive signal: the NULL dereference is only reachable after the DXGI Desktop Duplication driver fails to re-initialize following an environmental event (GPU reset, display hot-plug, or session change). That precondition is largely outside an attacker's control, so reliable remote triggering is questionable - the AV:N rating should be verified against the fact that the triggering conditions described are local/environmental rather than attacker-supplied. CISA's SSVC framework reinforces the low-urgency read: Exploitation=none, Automatable=no, Technical Impact=partial. There is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or probable near-term exploitation. The only impact is a server crash (recoverable DoS), not code execution or data compromise. Net: a legitimate bug worth patching on maintenance cadence, but not an emergency; treat the AV:N/PR:N framing with caution given the environmental trigger.

On a Windows host running TightVNC Server below 2.8.88, a GPU reset, monitor hot-plug, or RDP/console session switch causes the Win8ScreenDriver's DXGI Desktop Duplication re-initialization to fail, leaving m_drvImpl NULL. The next screen-capture cycle (executeDetection/getScreenBuffer/grabFb) dereferences the NULL pointer and crashes the server, dropping all remote sessions. No public exploit identified at time of analysis, and triggering is opportunistic/environmental rather than a reliable remote attack.