CERT/CC Warns VNC Viewers Can Be Crashed by Malicious Servers
Tech GuruQuick Answer
Deploy a supported UltraVNC build containing the fix. Replace TightVNC 1.3.10 with a maintained viewer confirmed to address this issue; restrict server connections while transitioning.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Windows viewer binaries and versions, approved remote servers and accounts used to run viewers. Exposure requires a vulnerable viewer to connect to a malicious or compromised server and process its crafted update. Follow CERT/CC’s product-specific guidance. Confirm a replacement viewer addresses this issue rather than assuming all maintained clients are unaffected. Verify the installed and running viewer version and representative authorized connections. Retain deployment records and investigate unexpected viewer crashes or server changes.
Last verified: 2026-11-13 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | TightVNC 1.3.10 Windows Viewer and affected UltraVNC Windows Viewers |
|---|---|
| Advisory | VU#644655 |
| CVE | CVE-2026-128321 |
| Authoritative release date | 2026-11-13 — November 13, 2026 at 00:08:48 UTC, from CERT/CC first-publication metadata. |
| Authority revision date | No separate revision date is provided by the authority. |
| Affected versions | CERT/CC identifies TightVNC Windows Viewer 1.3.10 and affected UltraVNC viewers processing Tight JPEG screen updates. It does not publish a complete UltraVNC affected-version range. |
| Fixed version | UltraVNC 1.8.2.8 contains the cited fix; use a supported release containing it, such as 1.8.3.1. CERT/CC identifies no coordinated fix for TightVNC 1.3.10. |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | CERT/CC does not confirm exploitation in the wild.; no exploitation claim is inferred. |
What Changed
A malicious or compromised VNC server can trigger a heap overflow in a connected viewer. CERT/CC reports demonstrated denial of service; code execution is a possible impact, not a demonstrated exploit outcome.
What To Validate Now
- Inventory. Inventory Windows viewer binaries and versions, approved remote servers and accounts used to run viewers.
- Establish applicability. Exposure requires a vulnerable viewer to connect to a malicious or compromised server and process its crafted update.
- Remediate. Follow CERT/CC’s product-specific guidance. Confirm a replacement viewer addresses this issue rather than assuming all maintained clients are unaffected.
- Validate. Verify the installed and running viewer version and representative authorized connections. Retain deployment records and investigate unexpected viewer crashes or server changes.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Authentication and transport encryption do not protect against a malicious server in the session. A trusted-server restriction reduces exposure but cannot protect against compromise of that server.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
