CVE-2026-107612

Name of the Vulnerable Software and Affected Versions GlavSoft TightVNC Server for Windows versions prior to 2.8.88

Description Incorrect permission assignment allows a local authenticated user to read or overwrite the inter-process communication (IPC) handles used between the TightVNC service and its desktop server process. The named shared memory segment in the Global namespace, which carries the pipe HANDLE values, is created with a NULL DACL (Discretionary Access Control List), meaning it lacks access restrictions. Additionally, the segment name is derived from a time-seeded srand(time(0)) value, making it predictable to one-second granularity. A low-privileged local process can open this mapping and tamper with the IPC channel of a service running as SYSTEM, potentially leading to session data disclosure, privilege escalation, or denial of service.

Recommendations Update GlavSoft TightVNC Server for Windows to version 2.8.88 or later.