CVE-2026-107614

Name of the Vulnerable Software and Affected Versions GlavSoft TightVNC Server for Windows versions prior to 2.8.88

Description An integer underflow occurs in the trimTransparent() function within WinCursorShapeUtils when a cursor shape with a width or height of zero is processed on the DXGI capture path. This allows a local authenticated user to crash the server and potentially read out-of-bounds memory. The issue arises because the loop bound width - 1 wraps to 0xFFFFFFFF, leading to memory access approximately 4 GB beyond the 64 KB cursor buffer. Additionally, a monochrome cursor with a height of 1 is reduced to 0 because the getCursorHeight() function halves the height in place.

Recommendations Update GlavSoft TightVNC Server for Windows to version 2.8.88 or later.