Vulnerability · Published Oct 8, 2026 · Assigned by securin

CVE-2026-107613NULL pointer dereference in TightVNC Server Win8ScreenDriver after failed DXGI re-initialization

Medium 5.9

In plain English

A medium-severity null pointer dereference in TightVNC from GlavSoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.3%top 76.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A NULL pointer dereference vulnerability in the Win8ScreenDriver component of GlavSoft TightVNC Server for Windows before 2.8.88 allows an attacker to crash the server, causing a denial of service. When re-initialization of the DXGI Desktop Duplication driver fails in applyNewScreenProperties() (for example after a GPU reset, display hot-plug or session change), m_drvImpl is left NULL and is subsequently dereferenced without a check by executeDetection(), getScreenBuffer(), grabFb(), getScreenPropertiesChanged() and getCursorPosition().

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:22.04:LTS	tightvnc	no fix listed	UBUNTU-CVE-2026-107613
Ubuntu:24.04:LTS	tightvnc	no fix listed	UBUNTU-CVE-2026-107613
Ubuntu:26.04:LTS	tightvnc	no fix listed	UBUNTU-CVE-2026-107613

Affected products (as reported)

Vendor	Product	Versions
GlavSoft	TightVNC	0 – before 2.8.88

Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

TightVNC bug #1660 issue-tracking
TightVNC release notes (2.8.88) release-notes, patch