---
id: CVE-2026-107612
title: >-
  Incorrect permission assignment in GlavSoft TightVNC Server for Windows before
  2.8.88 allows a local authenticated user to read or overwrite the
  inter-process communication handles used between the TightVNC service and its
  desktop server…
summary: >-
  Incorrect permission assignment in GlavSoft TightVNC Server for Windows before
  2.8.88 allows a local authenticated user to read or overwrite the
  inter-process communication handles used between the TightVNC service and its
  desktop server…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-338
  - CWE-732
vendor: GlavSoft
product: TightVNC
affected:
  - TightVNC < 2.8.88
published: '2026-10-08'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T21:10:00.133'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-107612'
references:
  - url: 'https://sourceforge.net/p/vnc-tight/bugs/1658/'
    label: 33c584b5-0579-4c06-b2a0-8d8329fcab9c
  - url: 'https://www.tightvnc.com/whatsnew.php'
    label: 33c584b5-0579-4c06-b2a0-8d8329fcab9c
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-08T14:01:50.062814Z'
ingestedAt: '2026-10-08T14:47:16.340Z'
---

## Overview

Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communication handles used between the TightVNC service and its desktop server process. The named shared memory segment in the Global\ namespace that carries the pipe HANDLE values is created with a NULL DACL, and its name is derived from a time-seeded srand(time(0)) value that is predictable to one-second granularity. A low-privileged local process can open the mapping and tamper with the IPC channel of a service running as SYSTEM, potentially leading to disclosure of session data, privilege escalation, or denial of service.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.