What’s Vulnerable › Vulnerabilities

CVE-2026-107615: DLL search order hijacking via screenhooks libraries in TightVNC Server

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-08 · updated 2026-10-08
• Weakness: CWE-427

Description

An uncontrolled search path element vulnerability in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to execute arbitrary code with SYSTEM privileges. DynamicLibrary::init() (and ThemeLib) load screenhooks32.dll / screenhooks64.dll with LoadLibrary() using a bare file name and no LOAD_LIBRARY_SEARCH_* flags, so the TightVNC service follows the default DLL search order and loads an attacker-planted DLL from a writable directory earlier in that order (for example, an installation directory with permissive ACLs).

Affected products

• GlavSoft TightVNC: before 2.8.88 — fixed in 2.8.88

How to fix

Upgrade to a fixed version: GlavSoft TightVNC 2.8.88. Check the vendor advisory for mitigations.

References

• https://sourceforge.net/p/vnc-tight/bugs/1666/
• https://www.tightvnc.com/whatsnew.php

Get alerted when CVE-2026-107615 or the next vulnerability affects your stack