CVE-2026-107612 (GCVE-0-2026-107612)
Vulnerability from cvelistv5
Published
2026-10-08 13:39
Modified
2026-10-08 14:02
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communication handles used between the TightVNC service and its desktop server process. The named shared memory segment in the Global\ namespace that carries the pipe HANDLE values is created with a NULL DACL, and its name is derived from a time-seeded srand(time(0)) value that is predictable to one-second granularity. A low-privileged local process can open the mapping and tamper with the IPC channel of a service running as SYSTEM, potentially leading to disclosure of session data, privilege escalation, or denial of service.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107612",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T14:01:50.062814Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T14:02:27.703Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"TightVNC Server (desktop server IPC)"
],
"platforms": [
"Windows"
],
"product": "TightVNC",
"programFiles": [
"SharedMemory.cpp",
"DesktopServerWatcher.cpp"
],
"programRoutines": [
{
"name": "DesktopServerWatcher::execute()"
}
],
"vendor": "GlavSoft",
"versions": [
{
"lessThan": "2.8.88",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arjun Basnet from Securin"
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communication handles used between the TightVNC service and its desktop server process. The named shared memory segment in the Global\\ namespace that carries the pipe HANDLE values is created with a NULL DACL, and its name is derived from a time-seeded srand(time(0)) value that is predictable to one-second granularity. A low-privileged local process can open the mapping and tamper with the IPC channel of a service running as SYSTEM, potentially leading to disclosure of session data, privilege escalation, or denial of service."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-338",
"description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T13:39:55.702Z",
"orgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"shortName": "securin"
},
"references": [
{
"name": "TightVNC bug #1658",
"tags": [
"issue-tracking"
],
"url": "https://sourceforge.net/p/vnc-tight/bugs/1658/"
},
{
"name": "TightVNC release notes (2.8.88)",
"tags": [
"release-notes",
"patch"
],
"url": "https://www.tightvnc.com/whatsnew.php"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade TightVNC for Windows to version 2.8.88 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-05-30T00:00:00.000Z",
"value": "Reported to GlavSoft"
},
{
"lang": "en",
"time": "2026-06-02T00:00:00.000Z",
"value": "Vendor acknowledged"
},
{
"lang": "en",
"time": "2026-06-19T00:00:00.000Z",
"value": "TightVNC 2.8.88 released with fix"
}
],
"title": "World-accessible IPC shared memory with predictable name in TightVNC Server"
}
},
"cveMetadata": {
"assignerOrgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"assignerShortName": "securin",
"cveId": "CVE-2026-107612",
"datePublished": "2026-10-08T13:39:55.702Z",
"dateReserved": "2026-10-08T13:23:07.677Z",
"dateUpdated": "2026-10-08T14:02:27.703Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-107612\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-08T14:01:50.062814Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-08T14:01:55.171Z\"}}], \"cna\": {\"title\": \"World-accessible IPC shared memory with predictable name in TightVNC Server\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Arjun Basnet from Securin\"}], \"impacts\": [{\"capecId\": \"CAPEC-122\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-122 Privilege Abuse\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"GlavSoft\", \"modules\": [\"TightVNC Server (desktop server IPC)\"], \"product\": \"TightVNC\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2.8.88\", \"versionType\": \"custom\"}], \"platforms\": [\"Windows\"], \"programFiles\": [\"SharedMemory.cpp\", \"DesktopServerWatcher.cpp\"], \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"DesktopServerWatcher::execute()\"}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-05-30T00:00:00.000Z\", \"value\": \"Reported to GlavSoft\"}, {\"lang\": \"en\", \"time\": \"2026-06-02T00:00:00.000Z\", \"value\": \"Vendor acknowledged\"}, {\"lang\": \"en\", \"time\": \"2026-06-19T00:00:00.000Z\", \"value\": \"TightVNC 2.8.88 released with fix\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Upgrade TightVNC for Windows to version 2.8.88 or later.\"}], \"references\": [{\"url\": \"https://sourceforge.net/p/vnc-tight/bugs/1658/\", \"name\": \"TightVNC bug #1658\", \"tags\": [\"issue-tracking\"]}, {\"url\": \"https://www.tightvnc.com/whatsnew.php\", \"name\": \"TightVNC release notes (2.8.88)\", \"tags\": [\"release-notes\", \"patch\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communication handles used between the TightVNC service and its desktop server process. The named shared memory segment in the Global\\\\ namespace that carries the pipe HANDLE values is created with a NULL DACL, and its name is derived from a time-seeded srand(time(0)) value that is predictable to one-second granularity. A low-privileged local process can open the mapping and tamper with the IPC channel of a service running as SYSTEM, potentially leading to disclosure of session data, privilege escalation, or denial of service.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-732\", \"description\": \"CWE-732 Incorrect Permission Assignment for Critical Resource\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-338\", \"description\": \"CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)\"}]}], \"providerMetadata\": {\"orgId\": \"33c584b5-0579-4c06-b2a0-8d8329fcab9c\", \"shortName\": \"securin\", \"dateUpdated\": \"2026-10-08T13:39:55.702Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-107612\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-08T14:02:27.703Z\", \"dateReserved\": \"2026-10-08T13:23:07.677Z\", \"assignerOrgId\": \"33c584b5-0579-4c06-b2a0-8d8329fcab9c\", \"datePublished\": \"2026-10-08T13:39:55.702Z\", \"assignerShortName\": \"securin\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…