What’s Vulnerable › Vulnerabilities

CVE-2026-107614: Integer underflow in TightVNC Server cursor shape trimming leads to out-of-bounds read

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-08 · updated 2026-10-08
• Weakness: CWE-125

Description

An integer underflow in WinCursorShapeUtils::trimTransparent() in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to crash the server, and potentially read out-of-bounds memory, by causing a cursor shape with a width or height of zero to be processed on the DXGI capture path. The loop bound width - 1 wraps to 0xFFFFFFFF, producing an access roughly 4 GB beyond the 64 KB cursor buffer; a monochrome cursor of height 1 also becomes 0 because getCursorHeight() halves the height in place.

Affected products

• GlavSoft TightVNC: before 2.8.88 — fixed in 2.8.88

How to fix

Upgrade to a fixed version: GlavSoft TightVNC 2.8.88. Check the vendor advisory for mitigations.

References

• https://sourceforge.net/p/vnc-tight/bugs/1661/
• https://www.tightvnc.com/whatsnew.php

Get alerted when CVE-2026-107614 or the next vulnerability affects your stack