# VU#644655 TightVNC and UltraVNC viewers contain heap-based buffer overflow

URL: https://decisioninsights.ai/vu644655-tightvnc-and-ultravnc-viewers-contain-heap-based-buffer-overflow/

TightVNC and UltraVNC provide remote desktop access using the Remote Framebuffer protocol. A heap-based buffer overflow in the Tight JPEG decoding component affects the TightVNC Windows Viewer version 1.3.10 and affected UltraVNC Windows Viewers, and a malicious VNC server can trigger memory corruption that crashes the viewer.The DecompressJpegRect() function in the Windows viewer allocates a heap buffer based on a hardcoded maximum row width of 8,192 pixels. It converts JPEG pixel data using the rectangle width supplied by the server, and does not sufficiently verify that the output fits within that buffer. In an allocation tested with 256 bytes of padding, the out-of-bounds write began at a rectangle width of 8,257 pixels. The vulnerability is identified as CVE-2026-128321.Exploitation requires a vulnerable viewer to establish a session with an attacker-controlled or compromised VNC server and process a crafted update from it. Because a server can advertise a sufficiently large framebuffer, confirming that the rectangle fits within that framebuffer does not alone prevent the overflow. Authentication and transport encryption do not block exploitation by a malicious server taking part in the session.A VNC server under an attacker's control can corrupt heap memory in a connected vulnerable viewer, causing the application to terminate and the remote desktop session to be interrupted. Memory corruption may also allow arbitrary code execution with the privileges of the account running the viewer, though testing confirmed only denial of service.According to UltraVNC's release notes, the Tight JPEG heap overflow was fixed in version 1.8.2.8, and users are advised to upgrade to a current supported release containing that fix, such as version 1.8.3.1. Product-specific patch information appears in the Vendor Information section, which lists one or more vendors and refers to the full report. Efforts to reach TightVNC to coordinate a fix for the affected 1.3.10 Windows viewer were unsuccessful.Users should replace affected viewers with a maintained version or an alternative solution confirmed to address the vulnerability. Until a corrected viewer is deployed, connections should be limited to trusted VNC servers, which lowers exposure but does not guard against a compromised trusted server. Credit goes to re9rch for reporting; Michael Bragg wrote the document, first published 2026-11-13 and last updated 2026-11-13 00:08 UTC as revision 1.