CVE-2026-107612: World-accessible IPC shared memory with predictable name in TightVNC Server
Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communication handles used between the TightVNC service and its desktop server process. The named shared memory segment in the Global\ namespace that carries the pipe HANDLE values is created with a NULL DACL, and its name is derived from a time-seeded srand(time(0)) value that is predictable to one-second granularity. A low-privileged local process can open the mapping and tamper with the IPC channel of a service running as SYSTEM, potentially leading to disclosure of session data, privilege escalation, or denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GlavSoft TightVNC Server for Windowsto a version that resolves this vulnerability.Fixed in 2.8.88
Event History
Frequently Asked Questions
Which deployments are exposed?
GlavSoft TightVNC Server for Windows versions before 2.8.88 are affected. The highest-risk deployments are those where the TightVNC service runs as SYSTEM, because the exposed IPC data carries handles used between that service and the desktop server process.
What access does an attacker need?
An attacker needs local authenticated access, including a low-privileged local process. No user interaction is required; the attacker can predict the shared-memory name to one-second granularity and open the mapping to read or modify its contents.
How can an administrator verify whether an installation is vulnerable?
Confirm whether the installed TightVNC Server for Windows version is earlier than 2.8.88. On an affected system, the relevant shared-memory mapping is in the Global namespace and is created with a NULL DACL, making it accessible to other local users.