Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| UltraVNC | UltraVNC | affected |
|
||||||
| Glavsoft (TightVNC) | TightVNC | affected |
|
No data.
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://github.com/ultravnc/ultravnc |
|
| https://www.tightvnc.com/ |
|
Fri, 13 Nov 2026 00:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Tight JPEG decoding in TightVNC and UltraVNC viewers contains a heap-based buffer overflow because an attacker-controlled framebuffer rectangle width is not validated against a fixed-size decoding buffer. A malicious VNC server can cause an out-of-bounds heap write when a user connects, resulting in application crash and potentially other memory-corruption impacts. | |
| Title | Tight JPEG decoding in TightVNC and UltraVNC viewers contains a heap-based buffer overflow vulnerability | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: certcc
Published:
Updated: 2026-11-13T00:08:32.021Z
Reserved: 2026-11-13T00:02:00.631Z
Link: CVE-2026-128321
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
No weakness.