CVE-2026-107614
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
An integer underflow in WinCursorShapeUtils::trimTransparent() in TightVNC Server for Windows before 2.8.88 allows a local authenticated user to crash the server and potentially read out-of-bounds memory by processing a cursor with zero width or height on the DXGI capture path.
Risk Assessment
A local attacker can cause a denial of service and potentially access out-of-bounds memory, leading to service disruption or information disclosure.
Recommendation
Update TightVNC Server to version 2.8.88 or later.
Other vulnerabilities in TightVNC Server
Original NVD description (English source)
An integer underflow in WinCursorShapeUtils::trimTransparent() in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to crash the server, and potentially read out-of-bounds memory, by causing a cursor shape with a width or height of zero to be processed on the DXGI capture path. The loop bound width - 1 wraps to 0xFFFFFFFF, producing an access roughly 4 GB beyond the 64 KB cursor buffer; a monochrome cursor of height 1 also becomes 0 because getCursorHeight() halves the height in place.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS