TightVNC and UltraVNC viewers have Tight JPEG heap overflow (CVE-2026-128321)
Original title: VU#644655: TightVNC and UltraVNC Viewer contains a heap-based buffer overflow
A malicious VNC server can crash TightVNC 1.3.10 and affected UltraVNC viewers; only denial of service was shown.
CERT/CC says DecompressJpegRect() in the Tight JPEG decoder of TightVNC Windows Viewer 1.3.10 and affected UltraVNC Windows viewers allocates a heap buffer for a maximum row width of 8,192 pixels but writes using the server-supplied rectangle width. A malicious or compromised VNC server can send an oversized Tight JPEG rectangle and corrupt heap memory. Testing confirmed denial of service; arbitrary code execution as the viewer user was not shown. UltraVNC addressed it in 1.8.2.8; TightVNC did not respond about a fix for 1.3.10.
Unconfirmed: Arbitrary code execution may be possible, but testing confirmed only denial of service.
- Out-of-bounds writes began at a rectangle width of 8,257 pixels in a padded test allocation.
- Checking the rectangle against the advertised framebuffer does not stop the overflow.
- Authentication and transport encryption do not stop a malicious server in the session.
- UltraVNC users should move to a release with the fix, such as 1.8.3.1.
- Reporter re9rch; public date November 13, 2026; document revision 1.
Impact: Heap corruption that crashes the viewer; code execution unconfirmed
| Product | Affected | Fixed in |
|---|---|---|
| TightVNC Windows Viewer | 1.3.10 | — |
| UltraVNC Windows Viewer | — | 1.8.2.8; current supported release such as 1.8.3.1 |
- 1.Upgrade UltraVNC to a release containing the 1.8.2.8 fix, such as 1.8.3.1.
- 2.Replace affected TightVNC 1.3.10 viewers with a maintained viewer confirmed to fix the issue.
- 3.Until then, connect only to trusted VNC servers.
- CVEs
- CVE-2026-128321
- Organizations
- CERT/CC
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-128321 | — | — | — |
From the original article
2 min read at kb.cert.orgOverview A heap-based buffer overflow exists in the Tight JPEG decoding component of the TightVNC Windows Viewer version 1. 3. 10 and affected UltraVNC Windows Viewers.
kb.cert.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.