Heap-Based Buffer Overflow in TightVNC and UltraVNC Viewers

CVE-2026-128321

What is CVE-2026-128321?

A vulnerability in TightVNC and UltraVNC viewers allows an attacker to exploit a heap-based buffer overflow. When an unvalidated framebuffer rectangle width is processed, this can lead to an out-of-bounds write in the memory heap. An attacker-controlled VNC server can trigger this vulnerability when a user connects, resulting in an application crash and potentially allowing memory corruption. Users are advised to apply the latest security patches to mitigate risks associated with this vulnerability.

References