{"id":"CVE-2026-107612","published":"2026-10-08T14:16:49.877","lastModified":"2026-10-08T21:10:00.133","description":"Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communication handles used between the TightVNC service and its desktop server process. The named shared memory segment in the Global\\ namespace that carries the pipe HANDLE values is created with a NULL DACL, and its name is derived from a time-seeded srand(time(0)) value that is predictable to one-second granularity. A low-privileged local process can open the mapping and tamper with the IPC channel of a service running as SYSTEM, potentially leading to disclosure of session data, privilege escalation, or denial of service.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-338","CWE-732"],"vendors":[],"products":[],"references":[{"url":"https://sourceforge.net/p/vnc-tight/bugs/1658/","tags":[]},{"url":"https://www.tightvnc.com/whatsnew.php","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A local authenticated user can manipulate IPC handles between TightVNC service and desktop server processes due to predictable shared memory names and NULL DACL permissions, potentially leading to privilege escalation or data disclosure.","exploitability":"Exploitation requires a local authenticated account with access to the TightVNC service process, which is moderately difficult but feasible since the vulnerable version allows local users to interact with the service.","blast_radius":"The impact could be significant as a low-privileged user could potentially read or overwrite critical IPC handles used by the TightVNC service running as SYSTEM, leading to privilege escalation or denial of service.","remediation":"Upgrade to TightVNC Server 2.8.88 or later to fix the NULL DACL and predictable shared memory naming issue.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["vnc","ipc","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:22:20.500Z"}}