{"id":"CVE-2026-107611","revision":"5a6a301b4359478289ec58cfed2bbcc3","records":[{"revision":"5a6a301b4359478289ec58cfed2bbcc3","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-107611","aliases":[],"title":"Out-of-bounds read in TightVNC Viewer ZRLE palette decoding","description":"An out-of-bounds read vulnerability in the ZRLE decoder of GlavSoft TightVNC Viewer for Windows before 2.8.88 allows a malicious or compromised VNC server to read heap memory beyond the palette allocation and crash the viewer by sending ZRLE-encoded tiles whose palette indices exceed the declared palette size. readPaletteRleTile() and readPackedPaletteTile() use the attacker-supplied index to look up colours without validating it against the palette size; out-of-bounds heap data is copied into the framebuffer (garbled display) or the read faults, terminating the viewer.","state":0,"publishedAt":"2026-10-08T13:39:48.883+00:00","modifiedAt":"2026-10-08T14:03:01.404+00:00","affected":[{"ecosystem":"Vendor product","name":"TightVNC","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"GlavSoft\",\n                    \"product\": \"TightVNC\",\n                    \"platforms\": [\n                        \"Windows\"\n                    ],\n                    \"modules\": [\n                        \"TightVNC Viewer (ZRLE decoder)\"\n                    ],\n                    \"programFiles\": [\n                        \"ZrleDecoder.cpp\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"readPaletteRleTile()\"\n                        },\n                        {\n                            \"name\": \"readPackedPaletteTile()\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.8.88\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","score":7.1,"severity":"HIGH"}],"references":["https://sourceforge.net/p/vnc-tight/bugs/1657/","https://www.tightvnc.com/whatsnew.php"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107611","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-107611","identifiers":["CVE-2026-107611"]},"retained":false,"historicalAffected":[]}],"coverage":[]}