CVE-2026-107613

Name of the Vulnerable Software and Affected Versions GlavSoft TightVNC Server for Windows versions prior to 2.8.88

Description A NULL pointer dereference in the Win8ScreenDriver component allows an attacker to crash the server, resulting in a denial of service. This occurs when the re-initialization of the DXGI Desktop Duplication driver fails within the applyNewScreenProperties() function, such as after a GPU reset, display hot-plug, or session change. Consequently, the m drvImpl variable remains NULL and is dereferenced without validation by the functions executeDetection(), getScreenBuffer(), grabFb(), getScreenPropertiesChanged(), and getCursorPosition().

Recommendations Update GlavSoft TightVNC Server for Windows to version 2.8.88 or later.