A vulnerability in TightVNC Viewer allows attackers to execute code on Windows PCs before the password prompt appears This article explores vulnerability tightvnc viewer. . This exploit is based on research by SeongJoon Cho of SSD Labs Korea, which includes a proof-of-concept exploit targeting TightVNC 2.8.88 x64.
The attack exploits a malicious VNC server that corrupts the viewer's memory, affecting the viewer component rather than any Windows machine running a TightVNC server. Large dimensions result in the value wrapping around, leading to an incorrect allocation.
It first modifies an outgoing buffer’s length to leak nearby memory, revealing addresses needed to bypass address randomization. Then, it redirects a function call and uses return-oriented programming to launch a process through Windows’ CreateProcessW function. This method differs from VNC hijacking, which depends on weak passwords, and from remote access tools that disguise themselves as installers, where users unwittingly install malicious software.
However, TightVNC's official release notices indicate October 2 and October 5 security updates, leaving the exact fix date unclear. Administrators should update affected viewers, disable unnecessary Listening Mode, restrict access to trusted systems, and avoid untrusted VNC servers.
