{"id":"CVE-2026-128321","state":"PUBLISHED","title":"Tight JPEG decoding in TightVNC and UltraVNC viewers contains a heap-based buffer overflow vulnerability","description":"Tight JPEG decoding in TightVNC and UltraVNC viewers contains a heap-based buffer overflow because an attacker-controlled framebuffer rectangle width is not validated against a fixed-size decoding buffer. A malicious VNC server can cause an out-of-bounds heap write when a user connects, resulting in application crash and potentially other memory-corruption impacts.","publishedAt":"2026-11-13T00:08:32.021Z","updatedAt":"2026-11-13T00:08:32.021Z","severity":null,"assigner":"certcc","products":["UltraVNC UltraVNC","Glavsoft (TightVNC) TightVNC"],"affected":[{"vendor":"UltraVNC","product":"UltraVNC","versions":[{"version":"1.8.2.4","status":"affected","lessThanOrEqual":"1.8.2.6","versionType":"custom"}]},{"vendor":"Glavsoft (TightVNC)","product":"TightVNC","versions":[{"version":"1.3.10","status":"affected","lessThanOrEqual":"1.3.10","versionType":"custom"}]}],"references":["https://www.tightvnc.com/","https://github.com/ultravnc/ultravnc"],"weaknesses":[],"ingestedAt":"2026-11-13T00:40:05.792Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/128xxx/CVE-2026-128321.json","commit":"3b0b4c6ebc31137776daa47510e1b43ef74f664a","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-128321","state":"PUBLISHED","datePublished":"2026-11-13T00:08:32.021Z","dateUpdated":"2026-11-13T00:08:32.021Z","assignerShortName":"certcc","assignerOrgId":"37e5125f-f79b-445b-8fad-9564f167944b","dateReserved":"2026-11-13T00:02:00.631Z"},"containers":{"cna":{"title":"Tight JPEG decoding in TightVNC and UltraVNC viewers contains a heap-based buffer overflow vulnerability","descriptions":[{"lang":"en","value":"Tight JPEG decoding in TightVNC and UltraVNC viewers contains a heap-based buffer overflow because an attacker-controlled framebuffer rectangle width is not validated against a fixed-size decoding buffer. A malicious VNC server can cause an out-of-bounds heap write when a user connects, resulting in application crash and potentially other memory-corruption impacts."}],"affected":[{"vendor":"UltraVNC","product":"UltraVNC","versions":[{"version":"1.8.2.4","status":"affected","lessThanOrEqual":"1.8.2.6","versionType":"custom"}]},{"vendor":"Glavsoft (TightVNC)","product":"TightVNC","versions":[{"version":"1.3.10","status":"affected","lessThanOrEqual":"1.3.10","versionType":"custom"}]}],"references":[{"url":"https://www.tightvnc.com/"},{"url":"https://github.com/ultravnc/ultravnc"}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-122 Heap-Based Buffer Overflow"}]}],"providerMetadata":{"shortName":"certcc","orgId":"37e5125f-f79b-445b-8fad-9564f167944b","dateUpdated":"2026-11-13T00:08:32.021Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"VINCE 4.0.3","env":"prod","origin":"https://cveawg.mitre.org/api/cve/CVE-2026-128321"}}}}}