{"slug":"tightvnc-viewer-preauth-rce","title":"TightVNC Viewer pre-auth RCE (no CVE yet)","shortName":"TightVNC Viewer","seoTitle":"TightVNC Viewer: affected versions, exploitation & detection","summary":"Integer overflow in framebuffer-size handling in the GlavSoft TightVNC for Windows Viewer (tvnviewer.exe). A malicious or hijacked VNC server can corrupt the viewer's memory during session setup and run code as the viewer's user before any password prompt. SSD tested 2.8.88 x64 only. No CVE as of 2 Nov 2026. No official CVSS. No known ITW. Not in CISA KEV (catalog 2026.10.30, checked 2 Nov 2026).","isExample":false,"draft":false,"family":"tightvnc-viewer-preauth-rce","kind":"single-product","aliases":["TightVNC Viewer pre-auth RCE","tvnviewer.exe","GlavSoft TightVNC Viewer"],"publishedAt":"2026-11-02","updatedAt":"2026-11-02","patchStatus":"patched","exploited":false,"scores":{"cvss":null,"epss":{"score":null,"percentile":null,"date":null,"sourceUrl":"https://api.first.org/data/v1/epss","checkedDate":"2026-11-02"},"kev":{"listed":false,"dateAdded":null,"dueDate":null,"catalogVersion":"2026.10.30","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-11-02"},"addedDate":"2026-11-02"},"priority":{"label":"watch"},"managementSummary":{"what":"Pre-auth remote code execution in the GlavSoft TightVNC for Windows Viewer (tvnviewer.exe) from an integer overflow in framebuffer-size handling. SSD tested 2.8.88 x64. No CVE as of 2 Nov 2026. No official CVSS. No EPSS score yet (no CVE to query). No known ITW. Not in CISA KEV (catalog 2026.10.30, checked 2 Nov 2026).","action":"Upgrade the Viewer to 2.8.90 (or later). That is the vendor-recommended 2.x release; the vendor has not explicitly tied it to this SSD bug. Disable Listening Mode where it is not needed, restrict TCP 5500 to trusted hosts, and do not connect to untrusted VNC servers."},"seenInTheWild":[],"seenInTheWildLinks":[{"title":"Cybernoz: disclosure does not establish active exploitation (2 Nov 2026)","url":"https://cybernoz.com/tightvnc-pre-auth-rce-vulnerability-lets-hackers-execute-code-on-windows-pcs-poc-released/","observer":"Cybernoz","metric":"third-party-stated"}],"whatChanged":{"date":"2026-11-02","items":[{"text":"New catalog page for TightVNC Viewer pre-auth RCE. No CVE assigned as of 2 Nov 2026.","headline":"New catalog page for TightVNC Viewer pre-auth RCE","section":"overview","date":"2026-11-02","addedDate":"2026-11-02","kind":"page"},{"text":"Added Am I affected checks, mitigations and response guidance","headline":"Added Am I affected checks, mitigations and response guidance","section":"am-i-affected","date":"2026-11-02","addedDate":"2026-11-02","kind":"page"},{"text":"SSD Secure Disclosure published the TightVNC Viewer pre-auth RCE advisory on 29 Oct 2026. No CVE assigned as of 2 Nov 2026. No known in-the-wild exploitation. Not in CISA KEV (catalog 2026.10.30, checked 2 Nov 2026). SSD includes a PoC for 2.8.88 x64, indexed as a researcher claim only.","headline":"SSD published Viewer pre-auth RCE; no CVE and no known ITW","section":"exploitation","date":"2026-11-02","sourceUrl":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/","alsoSourceUrl":"https://pasqualepillitteri.it/en/news/28103/tightvnc-viewer-rce-flaw-2-8-88-no-cve","addedDate":"2026-11-02"}]},"whatTheBugIs":"An integer overflow in framebuffer-size handling in the GlavSoft TightVNC for Windows Viewer (tvnviewer.exe). During session setup the server announces a screen size and the viewer allocates a pixel buffer. SSD Secure Disclosure (29 Oct 2026) says TightVNC computes that buffer size in a 32-bit integer, so a malicious or hijacked VNC server can corrupt the viewer's memory and run code as the viewer's user before any password prompt. This page does not republish exploit code, payloads, offsets, or steps.\n\nSSD names two preconditions. No authentication is needed. Either the viewer is in Listening Mode (tvnviewer.exe -listen, or the GUI Listening Mode), which SSD says binds TCP 5500 on all interfaces with no IP restriction and no password, or a user connects the viewer to an attacker-controlled server. Compromise happens on connect, before any password prompt. SSD says the viewer accepts security type None.\n\nAffected, in SSD's wording: TightVNC 2.8.88 x64. Older builds and 32-bit builds are unconfirmed. SSD demonstrated the issue on 2.8.88 x64 only. Do not read that as a vendor not-affected statement for other builds.\n\nNo CVE was assigned as of 2 Nov 2026. There is no official CVSS. FIRST EPSS has no entry to query without a CVE (checked 2 Nov 2026). Not in CISA KEV (catalog 2026.10.30, released 2026-10-30T17:02:45.3665Z, 1,766 entries, checked 2 Nov 2026).\n\nSSD credits SeongJoon Cho of SSD Labs Korea. SSD says the vendor never replied and that a patch landed on 3 Oct 2026 without mentioning a security patch. TightVNC news dated 2 Oct 2026 calls 2.8.89 a Viewer security update. The 2.8.89 changelog adds checks for oversized framebuffers to prevent integer overflows when processing invalid data from a server. TightVNC news dated 5 Oct 2026 says 2.8.89 and 2.8.90 address several Viewer security issues and recommends 2.8.90. Those two builds are the fixed releases on this page; the vendor has not explicitly tied them to this SSD advisory. TightVNC 4.0.2 (28 Oct 2026) is a later 4.x maintenance release; its notes do not name a framebuffer or overflow fix, and this page does not treat 4.0.2 as a fix.\n\nNo primary source reports in-the-wild exploitation as of 2 Nov 2026. Cybernoz (2 Nov 2026) says the disclosure does not establish active exploitation. The glance badge is No known ITW, never not exploited.","attackPath":{"caption":"High-level only. Not a reproduction guide.","steps":[{"id":"reach","label":"Rogue or listening path","detail":"A rogue or hijacked VNC server, or an attacker who can reach a viewer in Listening Mode on TCP 5500."},{"id":"app","label":"Session setup data","detail":"The attacker sends crafted session-setup data to the Viewer. Conceptual impact class only."},{"id":"exploit","label":"Viewer memory corrupted","detail":"SSD: integer overflow in framebuffer-size handling corrupts the viewer's memory during session setup."},{"id":"shell","label":"Code as the viewer user","detail":"SSD: code runs as the user who opened the Viewer, before any password prompt."}]},"exploitation":{"kev":{"listed":false,"date":"2026-10-30","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"Not in CISA KEV (checked 2 Nov 2026) against catalog 2026.10.30 (released 2026-10-30T17:02:45.3665Z, 1,766 entries). No CVE is assigned, so there is no CVE row to list."},"firstSeen":{"date":null,"source":"Cybernoz (2 Nov 2026). SSD advisory 29 Oct 2026.","note":"No in-the-wild exploitation reported as of 2 Nov 2026. Cybernoz says the disclosure does not establish active exploitation. The SSD advisory does not report attacks. Badge: No known ITW. Never not exploited."},"vendorStatements":[{"vendor":"TightVNC (GlavSoft)","date":"2026-10-02","statement":"This security update includes important fixes that improve the security and stability of the Viewer. We strongly recommend that all users upgrade to version 2.8.89.","url":"https://www.tightvnc.com/news.php","retracted":false},{"vendor":"TightVNC (GlavSoft)","date":"2026-10-05","statement":"Versions 2.8.89 and 2.8.90 address several security issues in the Viewer and improve its handling of invalid data received from a server. We strongly recommend that all users upgrade to version 2.8.90.","url":"https://www.tightvnc.com/news.php","retracted":false}]},"timeline":[{"date":"2026-06-19","event":"TightVNC for Windows 2.8.88 released. SSD later tested this x64 Viewer build.","source":{"title":"News - TightVNC","url":"https://www.tightvnc.com/news.php","publisher":"TightVNC"},"kind":"vendor","addedDate":"2026-11-02"},{"date":"2026-10-02","event":"TightVNC for Windows 2.8.89 released. Vendor news calls it a Viewer security update. Changelog adds checks for oversized framebuffers to prevent integer overflows. The vendor does not name this SSD bug.","source":{"title":"News - TightVNC (2.8.89)","url":"https://www.tightvnc.com/news.php","publisher":"TightVNC"},"kind":"patch","key":true,"addedDate":"2026-11-02"},{"date":"2026-10-03","event":"SSD says the vendor never replied and that a patch landed on 3 Oct 2026 without mentioning a security patch. Vendor news dates 2.8.89 to 2 Oct 2026 and calls it a security update.","source":{"title":"TightVNC Viewer Pre-auth RCE","url":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/","publisher":"SSD Secure Disclosure"},"kind":"other","addedDate":"2026-11-02"},{"date":"2026-10-05","event":"TightVNC for Windows 2.8.90 released. Vendor says 2.8.89 and 2.8.90 address several Viewer security issues and recommends 2.8.90. The vendor does not name this SSD bug.","source":{"title":"News - TightVNC (2.8.90)","url":"https://www.tightvnc.com/news.php","publisher":"TightVNC"},"kind":"patch","key":true,"addedDate":"2026-11-02"},{"date":"2026-10-28","event":"TightVNC for Windows 4.0.2 released. Maintenance notes do not name this bug. Listed here as a later 4.x vendor release, not as a vendor-tied fix.","source":{"title":"News - TightVNC (4.0.2)","url":"https://www.tightvnc.com/news.php","publisher":"TightVNC"},"kind":"vendor","addedDate":"2026-11-02"},{"date":"2026-10-29","event":"SSD Secure Disclosure published TightVNC Viewer Pre-auth RCE. Credit: SeongJoon Cho, SSD Labs Korea. Affected: 2.8.88 x64. PoC included for that build. No CVE named.","source":{"title":"TightVNC Viewer Pre-auth RCE","url":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/","publisher":"SSD Secure Disclosure"},"kind":"disclosure","key":true,"addedDate":"2026-11-02"},{"date":"2026-10-29T09:04:11.601Z","event":"SSD Secure Disclosure posted the advisory link on Infosec Exchange at 09:04 UTC.","source":{"title":"SSD Secure Disclosure on Infosec Exchange","url":"https://infosec.exchange/@SSDSecureDisclosure/117523392207210708","publisher":"SSD Secure Disclosure"},"kind":"disclosure","addedDate":"2026-11-02"},{"date":"2026-10-29","event":"Public write-up states the 2.8.88 Viewer flaw was patched without a CVE.","source":{"title":"TightVNC Viewer RCE flaw in 2.8.88 patched without a CVE","url":"https://pasqualepillitteri.it/en/news/28103/tightvnc-viewer-rce-flaw-2-8-88-no-cve","publisher":"Pasquale Pillitteri"},"kind":"other","addedDate":"2026-11-02"},{"date":"2026-10-30","event":"Not in CISA KEV. Catalog 2026.10.30 released 2026-10-30T17:02:45.3665Z (1,766 entries). Rechecked 2 Nov 2026. No CVE is assigned, so there is no CVE row to list.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"other","key":true,"addedDate":"2026-11-02"}],"openNotes":[{"title":"No CVE assigned as of 2 Nov 2026","detail":"SSD's advisory does not name a CVE. A 29 Oct 2026 write-up states the flaw was patched without a CVE. There is no official CVSS and no FIRST EPSS row to query.","sources":[{"url":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/","date":"2026-10-29","publisher":"SSD Secure Disclosure"},{"url":"https://pasqualepillitteri.it/en/news/28103/tightvnc-viewer-rce-flaw-2-8-88-no-cve","date":"2026-10-29","publisher":"Pasquale Pillitteri"}]},{"title":"Older builds and 32-bit 2.8.88 are unconfirmed","detail":"SSD lists TightVNC 2.8.88 x64 only. Older Viewer builds and the 32-bit 2.8.88 build are absent from the advisory. They are unconfirmed, not vendor-stated not affected.","sources":[{"url":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/","date":"2026-10-29","publisher":"SSD Secure Disclosure"}]},{"title":"Vendor releases are not explicitly tied to this bug","detail":"2.8.89 (2 Oct 2026) and 2.8.90 (5 Oct 2026, recommended 2.x) are the Viewer security updates. 2.8.89 changelog adds oversized-framebuffer checks. TightVNC news calls 2.8.89 and 2.8.90 Viewer security updates. None of those notes name this SSD advisory or assign a CVE. 4.0.2 (28 Oct 2026) is a later 4.x maintenance release; its notes do not name a framebuffer or overflow fix and are not tied to this SSD bug. SSD says the vendor never replied and that a patch landed 3 Oct 2026 without mentioning a security patch. The 2 Oct versus 3 Oct dates both stand as sourced.","sources":[{"url":"https://www.tightvnc.com/news.php","date":"2026-10-05","publisher":"TightVNC"},{"url":"https://www.tightvnc.com/whatsnew.php","date":"2026-10-02","publisher":"TightVNC"},{"url":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/","date":"2026-10-29","publisher":"SSD Secure Disclosure"}]}],"defenderActions":[{"title":"Upgrade TightVNC Viewer to 2.8.90 or later","detail":"Take the vendor-recommended 2.x Viewer security update. The earlier 2 Oct Viewer security update already adds oversized-framebuffer checks. The vendor has not explicitly tied those releases to this SSD bug. Upgrade the Viewer, not only the Server.","priority":"now","links":[{"label":"TightVNC news","href":"https://www.tightvnc.com/news.php"}]},{"title":"Disable Listening Mode where it is not needed","detail":"SSD: Listening Mode binds TCP 5500 on all interfaces with no IP restriction and no password. Turn it off except during a session that needs a reverse connection.","priority":"now","links":[{"label":"SSD advisory","href":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/"}]},{"title":"Restrict TCP 5500 to trusted hosts","detail":"If Listening Mode must stay on, limit inbound TCP 5500 to known hosts. This reduces the network path. It does not replace a Viewer upgrade.","priority":"now","links":[{"label":"SSD advisory","href":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/"}]},{"title":"Do not connect the Viewer to untrusted VNC servers","detail":"SSD: compromise can happen when the Viewer connects outbound, before any password prompt. Do not open VNC addresses from unverified contacts.","priority":"now","links":[{"label":"SSD advisory","href":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/"}]},{"title":"Inventory Viewer hosts for 2.8.88 and earlier","detail":"CVE-keyed scanners will not flag this bug while it has no CVE. Record each Windows TightVNC Viewer version by hand or from the installed-apps list.","priority":"now","links":[{"label":"SSD advisory","href":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/"}]}],"detection":[{"title":"Inbound TCP 5500 to Viewer hosts","detail":"SSD: Listening Mode waits on TCP 5500. Hunt inbound 5500 to hosts that run tvnviewer.exe. A hit is a lead for an exposed listen path, not proof of code execution.","logSource":"Firewall or EDR network telemetry for inbound TCP 5500","kind":"generic","group":"edr","url":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/","date":"2026-10-29"},{"title":"Unexpected child processes of tvnviewer.exe","detail":"SSD: successful exploitation runs code as the Viewer user. Hunt unusual children of tvnviewer.exe. A child process is a lead, not proof of this bug.","logSource":"EDR process telemetry for tvnviewer.exe","kind":"generic","group":"edr","url":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/","date":"2026-10-29"},{"title":"Software-version inventory for TightVNC 2.8.88 and earlier","detail":"SSD tested 2.8.88 x64. Older and 32-bit builds are unconfirmed. CVE-keyed scanners will not flag this bug while it has no CVE. Inventory Viewer versions on Windows hosts.","logSource":"Software-version inventory (installed apps / Viewer About)","kind":"generic","url":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/","date":"2026-10-29"},{"title":"No public Nuclei, Sigma, Snort, or Suricata rules","detail":"None public as of 2 Nov 2026. Do not invent a rule from the advisory. Use the hunting pointers above.","logSource":"Public rule indexes (Nuclei, Sigma, Snort, Suricata)","kind":"generic","date":"2026-11-02","dateKind":"checked"}],"detectionRules":[],"detectionLinks":[],"amIAffected":{"summary":"SSD tested TightVNC Viewer 2.8.88 x64 for Windows. Older and 32-bit builds are unconfirmed. Preconditions: Listening Mode on TCP 5500, or a user connecting to an attacker-controlled server. No authentication is needed. CVE-keyed scanners will not flag this bug.","checks":[{"id":"v2s-aia-tightvnc-viewer-preauth-rce-version-1","kind":"version","title":"Record the installed TightVNC Viewer version","detail":"SSD tested 2.8.88 x64. Compare the Viewer About box or the Windows installed-apps list to 2.8.88, then to 2.8.89 and 2.8.90. This is inventory only.","command":"On each Windows host, open TightVNC Viewer Help > About, or check Settings > Apps > Installed apps for TightVNC, and record DisplayVersion.","affectedMeans":"The installed Viewer is 2.8.88 x64, or another Viewer build you treat as in-scope until you can confirm it is a later vendor release.","fixedMeans":"The installed Viewer is 2.8.89, 2.8.90, or a later vendor release you accept as the upgrade path.","notes":"Vendor releases are not explicitly tied to this SSD bug. Upgrade the Viewer, not only the Server. Do not send crafted VNC traffic.","sources":[{"url":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/","date":"2026-10-29","publisher":"SSD Secure Disclosure"},{"url":"https://www.tightvnc.com/news.php","date":"2026-10-05","publisher":"TightVNC"}]},{"id":"v2s-aia-tightvnc-viewer-preauth-rce-package-2","kind":"package","title":"Windows uninstall inventory for TightVNC","detail":"Read-only installed-app query. Use it to find Viewer hosts when CVE-keyed scanners will not flag this bug.","command":"Get-ItemProperty HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*, HKLM:\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\* | Where-Object { $_.DisplayName -like '*TightVNC*' } | Select-Object DisplayName, DisplayVersion","affectedMeans":"A TightVNC install shows DisplayVersion 2.8.88, or an older Viewer you have not yet confirmed.","fixedMeans":"DisplayVersion is 2.8.89, 2.8.90, or a later vendor release, or TightVNC Viewer is not installed.","notes":"Inventory only. 32-bit and older builds remain unconfirmed.","sources":[{"url":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/","date":"2026-10-29","publisher":"SSD Secure Disclosure"}]},{"id":"v2s-aia-tightvnc-viewer-preauth-rce-config-3","kind":"config","title":"Record whether the Viewer is in Listening Mode on TCP 5500","detail":"SSD: Listening Mode binds 0.0.0.0:5500 with no IP restriction and no password. Check the Viewer tray icon and whether anything is listening on TCP 5500.","command":"netstat -ano | findstr :5500","affectedMeans":"A Viewer host is listening on TCP 5500, especially on 2.8.88 x64.","fixedMeans":"Nothing is listening on TCP 5500, or Listening Mode is off and inbound 5500 is blocked.","notes":"A listen socket is a precondition, not proof of compromise. Do not connect a test server to the Viewer.","sources":[{"url":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/","date":"2026-10-29","publisher":"SSD Secure Disclosure"}]},{"id":"v2s-aia-tightvnc-viewer-preauth-rce-exposure-4","kind":"exposure","title":"Scoped search for inbound TCP 5500 in your own ranges","detail":"Port 5500 is the SSD-named Listening Mode port. Product fingerprint only, not a vulnerable count. Scope the query to your estate.","command":"shodan search 'port:5500 net:<your-range>'","affectedMeans":"A host in your range accepts inbound TCP 5500 and runs an affected or unconfirmed TightVNC Viewer.","fixedMeans":"No host in your range accepts inbound TCP 5500, or every listen host is on a later vendor Viewer release and restricted to trusted sources.","notes":"Port 5500 is used by more than TightVNC. A port hit is not proof of this bug.","sources":[{"url":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/","date":"2026-10-29","publisher":"SSD Secure Disclosure"}]}],"limits":["SSD tested 2.8.88 x64 only. Older and 32-bit builds are unconfirmed.","Vendor releases are not explicitly tied to this SSD bug.","The Shodan check is a port match, not a vendor inventory command.","Do not send crafted VNC session-setup data."],"sources":[{"url":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/","date":"2026-10-29","publisher":"SSD Secure Disclosure"},{"url":"https://www.tightvnc.com/news.php","date":"2026-10-05","publisher":"TightVNC"}],"updatedAt":"2026-11-02","addedDate":"2026-11-02"},"mitigations":{"summary":"SSD names Listening Mode and outbound connections as the two paths. Until you can upgrade the Viewer, disable unused Listening Mode, restrict TCP 5500, and do not connect to untrusted VNC servers. The vendor has not published a workaround bulletin for this SSD bug.","items":[{"title":"Disable Listening Mode where it is not needed","detail":"SSD: Listening Mode binds TCP 5500 on all interfaces with no IP restriction and no password. Turn it off except during a reverse-connection session.","limits":"Not a software fix. The outbound path remains if someone connects the Viewer to an untrusted server. Still upgrade to 2.8.90 (or later).","verify":"The Viewer tray icon is not in Listening Mode, and netstat shows nothing listening on TCP 5500. Recheck after the next logon.","source":{"url":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/","date":"2026-10-29","publisher":"SSD Secure Disclosure"}},{"title":"Restrict inbound TCP 5500 to trusted hosts","detail":"If Listening Mode must stay on, limit inbound TCP 5500 to known hosts at the host firewall or edge.","limits":"Not a software fix. Does not help if a user connects outbound to an attacker-controlled server.","verify":"The host firewall or edge filter allows TCP 5500 only from named trusted addresses, and a probe from an untrusted address is denied. Do not send crafted VNC data.","source":{"url":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/","date":"2026-10-29","publisher":"SSD Secure Disclosure"}},{"title":"Do not connect the Viewer to untrusted VNC servers","detail":"SSD: outbound connect to an attacker-controlled address is the second path, before any password prompt.","limits":"Depends on operator behaviour. Does not close an exposed Listening Mode path.","verify":"Operators have a written rule not to open VNC addresses from unverified contacts, and recent Viewer connection history shows only expected servers.","source":{"url":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/","date":"2026-10-29","publisher":"SSD Secure Disclosure"}}],"updatedAt":"2026-11-02","addedDate":"2026-11-02"},"response":{"summary":"If a Viewer host was in Listening Mode or connected to an untrusted server while on 2.8.88 x64, treat the Viewer user as exposed. Upgrade the Viewer, disable unused Listening Mode, and hunt unexpected children of tvnviewer.exe. No sourced persistence paths were published.","containment":[{"title":"Disable Listening Mode and block inbound TCP 5500","detail":"SSD: Listening Mode is a pre-auth network path. Turn it off and restrict 5500 while you upgrade.","sources":[{"url":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/","date":"2026-10-29","publisher":"SSD Secure Disclosure"}]},{"title":"Upgrade the Viewer to 2.8.90 (or later)","detail":"Vendor-recommended 2.x release is 2.8.90. The vendor has not explicitly tied that build to this SSD bug.","sources":[{"url":"https://www.tightvnc.com/news.php","date":"2026-10-05","publisher":"TightVNC"}]},{"title":"Hunt unexpected children of tvnviewer.exe","detail":"SSD: code runs as the Viewer user. Review EDR for unusual children of tvnviewer.exe during the exposure window. A child process is a lead, not proof.","sources":[{"url":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/","date":"2026-10-29","publisher":"SSD Secure Disclosure"}]}],"rotate":[{"item":"Credentials and secrets the Viewer user could reach","reason":"General: if code ran as the Viewer user, treat secrets that account could read as exposed. No bug-specific rotate list was published in the sources we opened.","generic":true,"sources":[{"url":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/","date":"2026-10-29","publisher":"SSD Secure Disclosure"}]}],"evidence":[{"title":"Installed Viewer version from before the upgrade","detail":"Keep the Viewer About string or DisplayVersion so you can show whether the host was 2.8.88 x64.","sources":[{"url":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/","date":"2026-10-29","publisher":"SSD Secure Disclosure"}]},{"title":"Listening Mode and TCP 5500 state","detail":"Keep firewall and netstat evidence for inbound 5500 during the exposure window.","sources":[{"url":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/","date":"2026-10-29","publisher":"SSD Secure Disclosure"}]},{"title":"EDR process-creation logs for tvnviewer.exe","detail":"Keep child-process records for the Viewer user from the exposure window. No sourced persistence path was published.","generic":true,"sources":[{"url":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/","date":"2026-10-29","publisher":"SSD Secure Disclosure"}]}],"limits":["No sourced persistence paths or IOCs were published.","SSD tested 2.8.88 x64 only.","No in-the-wild exploitation reported as of 2 Nov 2026.","Vendor releases are not explicitly tied to this SSD bug."],"sources":[{"url":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/","date":"2026-10-29","publisher":"SSD Secure Disclosure"},{"url":"https://www.tightvnc.com/news.php","date":"2026-10-05","publisher":"TightVNC"}],"updatedAt":"2026-11-02","addedDate":"2026-11-02"},"bulletins":[],"coverage":[{"title":"TightVNC Viewer Pre-auth RCE","publisher":"SSD Secure Disclosure","url":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/","date":"2026-10-29","type":"research","addedDate":"2026-11-02"},{"title":"News - TightVNC (2.8.89, 2.8.90)","publisher":"TightVNC","url":"https://www.tightvnc.com/news.php","date":"2026-10-28","type":"vendor","addedDate":"2026-11-02"},{"title":"What's New in Each Version - TightVNC","publisher":"TightVNC","url":"https://www.tightvnc.com/whatsnew.php","date":"2026-10-28","type":"vendor","addedDate":"2026-11-02"},{"title":"TightVNC Viewer RCE flaw in 2.8.88 patched without a CVE","publisher":"Pasquale Pillitteri","url":"https://pasqualepillitteri.it/en/news/28103/tightvnc-viewer-rce-flaw-2-8-88-no-cve","date":"2026-10-29","type":"news","addedDate":"2026-11-02"},{"title":"TightVNC Pre-Auth RCE Vulnerability Lets Hackers Execute Code on Windows PCs, PoC Released","publisher":"Cybernoz","url":"https://cybernoz.com/tightvnc-pre-auth-rce-vulnerability-lets-hackers-execute-code-on-windows-pcs-poc-released/","date":"2026-11-02","type":"news","addedDate":"2026-11-02"},{"title":"CISA KEV catalog JSON (no TightVNC Viewer CVE listed; catalog 2026.10.30)","publisher":"CISA","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-10-30","type":"government","addedDate":"2026-11-02"}],"posts":[],"research":[{"title":"TightVNC Viewer Pre-auth RCE","url":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/","authors":"SeongJoon Cho, SSD Labs Korea","date":"29 Oct 2026"}],"impact":{"kind":"single-product","product":"GlavSoft TightVNC Viewer for Windows","versions":[{"version":"TightVNC Viewer 2.8.88 x64 (Windows)","status":"affected","versions":"2.8.89 / 2.8.90","statusLabel":"SSD tested 2.8.88 x64. Vendor releases; the vendor has not explicitly tied them to this bug.","addedDate":"2026-11-02"},{"version":"Older TightVNC Viewer builds and 32-bit 2.8.88","status":"no-statement-yet","statusLabel":"Unconfirmed. SSD tested 2.8.88 x64 only.","addedDate":"2026-11-02"}]},"pocs":[{"title":"SSD TightVNC Viewer Pre-auth RCE (for defenders)","url":"https://ssd-disclosure.com/tightvnc-viewer-pre-auth-rce/","source":"SeongJoon Cho, SSD Labs Korea","validationStatus":"unverified","validationDate":null,"listedDate":"2026-10-29","notes":"RCE claimed by SSD (researcher's claim, not a vuln2shell validation), 29 Oct 2026. Demonstrated only by SSD on 2.8.88 x64. No independent validation. Index link only. This site does not republish exploit code, payloads, offsets, or steps.","addedDate":"2026-11-02"}],"pocEmptyState":"SSD advisory includes a PoC for 2.8.88 x64, claimed by the researcher on 29 Oct 2026. Independent validation: not verified.","_feed":{"page":"https://vuln2shell.com/vulns/tightvnc-viewer-preauth-rce","json":"https://vuln2shell.com/vulns/tightvnc-viewer-preauth-rce.json","iocsCsv":"https://vuln2shell.com/vulns/tightvnc-viewer-preauth-rce/iocs.csv","stix":"https://vuln2shell.com/vulns/tightvnc-viewer-preauth-rce/stix.json","badges":{"patch":"Patched","itw":"No known ITW","poc":"Public PoC (unverified RCE)"}}}