TightVNC Viewer EUVD-2026-94975

Exploitation requires the victim to run TightVNC Viewer for Windows (version before 2.8.88) and to initiate a VNC session to an attacker-controlled or compromised server (UI:R); the server must negotiate ZRLE encoding and send tiles whose palette indices exceed the declared palette size. Limiting factors: no code execution is achieved, impact is confined to crashing the viewer (DoS) and limited heap disclosure into the rendered framebuffer; exploitation is server-to-client, so the attacker must control or MITM the server the victim connects to rather than reaching the victim directly. No authentication of the viewer is required by the server side (PR:N), and default viewer configurations are affected since ZRLE is a standard supported encoding.

This is a medium-to-high severity client-side flaw (CVSS 7.1) whose score is driven almost entirely by availability impact (A:H, viewer crash) plus a low confidentiality leak (C:L, heap bytes rendered into the framebuffer). The CVSS vector is internally consistent with the description: AV:N/AC:L/PR:N are correct because a VNC server transmits the malicious ZRLE tiles over the network with no authentication of the viewer, and UI:R correctly reflects that the victim must actively initiate a connection to the attacker-controlled or compromised server. This is a reverse/server-to-client attack, not a remotely reachable service bug, which materially lowers real-world risk versus the raw 7.1 would suggest. No EPSS score was provided, so exploitation probability cannot be quantified. There is no CISA KEV listing and no POC referenced - exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. Net: this is a legitimate bug to patch (an out-of-bounds read is confirmed by vendor with a fix), but it is a lower operational priority than its 7.1 implies because it requires user interaction, an attacker-controlled server, and yields only crash plus minor information disclosure rather than code execution. Missing signals (EPSS, SSVC, POC) should be treated as unknown, not as low - verify against vendor advisory if prioritizing.

An attacker stands up a malicious VNC server (or compromises a legitimate one) and lures a TightVNC Viewer user to connect, for example via a phishing link, a rogue connection profile, or a man-in-the-middle on an existing session. Once connected, the server sends ZRLE-encoded tiles containing palette indices larger than the declared palette size; readPaletteRleTile()/readPackedPaletteTile() use those indices without bounds-checking, reading heap memory beyond the palette allocation. The result is either garbled heap data copied into the displayed framebuffer (minor information disclosure) or a read fault that terminates the viewer. No public exploit identified at time of analysis.