CVE-2026-107615

Name of the Vulnerable Software and Affected Versions GlavSoft TightVNC Server for Windows versions prior to 2.8.88

Description A local authenticated user can execute arbitrary code with SYSTEM privileges due to an uncontrolled search path element. The DynamicLibrary::init() function (and ThemeLib) uses LoadLibrary() to load screenhooks32.dll and screenhooks64.dll using a bare file name without LOAD LIBRARY SEARCH * flags. This causes the service to follow the default DLL search order, allowing it to load a malicious DLL placed by an attacker in a writable directory that appears earlier in the search sequence, such as an installation directory with permissive Access Control Lists (ACLs).

Recommendations Update GlavSoft TightVNC Server for Windows to version 2.8.88 or later.