CVE-2026-107611 Out-of-bounds read in TightVNC Viewer ZRLE palette decoding
A malicious VNC server can trigger an out-of-bounds read in TightVNC Viewer, leaking heap memory or crashing the application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-107611?
CVE-2026-107611 is a high-severity vulnerability in GlavSoft TightVNC, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An out-of-bounds read vulnerability in the ZRLE decoder of GlavSoft TightVNC Viewer for Windows before 2.8.88 allows a malicious or compromised VNC server to read heap memory beyond the palette allocation and crash the viewer by sending ZRLE-encoded tiles whose palette indices exceed the declared palette size. readPaletteRleTile() and readPackedPaletteTile() use the attacker-supplied index to look up colours without validating it against the palette size; out-of-bounds heap data is copied into the framebuffer (garbled display) or the read faults, terminating the viewer.
Weakness: CWE-125
Which versions are affected by CVE-2026-107611?
How do I fix CVE-2026-107611?
No fix has been published for CVE-2026-107611 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-107611 being exploited?
There is no known exploitation of CVE-2026-107611 in the wild and no public exploit code.
Sources
Also known as GHSA-r575-8hw6-vfq3.