{"api_version":"1","generated_at":"2026-10-08T21:03:39+00:00","cve":"CVE-2026-107612","urls":{"html":"https://cve.report/CVE-2026-107612","api":"https://cve.report/api/cve/CVE-2026-107612.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-107612","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-107612"},"summary":{"title":"World-accessible IPC shared memory with predictable name in TightVNC Server","description":"Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communication handles used between the TightVNC service and its desktop server process. The named shared memory segment in the Global\\ namespace that carries the pipe HANDLE values is created with a NULL DACL, and its name is derived from a time-seeded srand(time(0)) value that is predictable to one-second granularity. A low-privileged local process can open the mapping and tamper with the IPC channel of a service running as SYSTEM, potentially leading to disclosure of session data, privilege escalation, or denial of service.","state":"PUBLISHED","assigner":"securin","published_at":"2026-10-08 14:16:49","updated_at":"2026-10-08 15:17:45"},"problem_types":["CWE-338","CWE-732","CWE-732 CWE-732 Incorrect Permission Assignment for Critical Resource","CWE-338 CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)"],"metrics":[{"version":"3.1","source":"33c584b5-0579-4c06-b2a0-8d8329fcab9c","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://sourceforge.net/p/vnc-tight/bugs/1658/","name":"https://sourceforge.net/p/vnc-tight/bugs/1658/","refsource":"33c584b5-0579-4c06-b2a0-8d8329fcab9c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.tightvnc.com/whatsnew.php","name":"https://www.tightvnc.com/whatsnew.php","refsource":"33c584b5-0579-4c06-b2a0-8d8329fcab9c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-107612","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107612","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"GlavSoft","product":"TightVNC","version":"affected 2.8.88 custom","platforms":["Windows"]}],"timeline":[{"source":"CNA","time":"2026-05-30T00:00:00.000Z","lang":"en","value":"Reported to GlavSoft"},{"source":"CNA","time":"2026-06-02T00:00:00.000Z","lang":"en","value":"Vendor acknowledged"},{"source":"CNA","time":"2026-06-19T00:00:00.000Z","lang":"en","value":"TightVNC 2.8.88 released with fix"}],"solutions":[{"source":"CNA","title":"","value":"Upgrade TightVNC for Windows to version 2.8.88 or later.","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Arjun Basnet from Securin","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-107612","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-08T14:01:50.062814Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-08T14:02:27.703Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","modules":["TightVNC Server (desktop server IPC)"],"platforms":["Windows"],"product":"TightVNC","programFiles":["SharedMemory.cpp","DesktopServerWatcher.cpp"],"programRoutines":[{"name":"DesktopServerWatcher::execute()"}],"vendor":"GlavSoft","versions":[{"lessThan":"2.8.88","status":"affected","version":"0","versionType":"custom"}]}],"credits":[{"lang":"en","type":"finder","value":"Arjun Basnet from Securin"}],"descriptions":[{"lang":"en","value":"Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communication handles used between the TightVNC service and its desktop server process. The named shared memory segment in the Global\\ namespace that carries the pipe HANDLE values is created with a NULL DACL, and its name is derived from a time-seeded srand(time(0)) value that is predictable to one-second granularity. A low-privileged local process can open the mapping and tamper with the IPC channel of a service running as SYSTEM, potentially leading to disclosure of session data, privilege escalation, or denial of service."}],"impacts":[{"capecId":"CAPEC-122","descriptions":[{"lang":"en","value":"CAPEC-122 Privilege Abuse"}]}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-732","description":"CWE-732 Incorrect Permission Assignment for Critical Resource","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-338","description":"CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-08T13:39:55.702Z","orgId":"33c584b5-0579-4c06-b2a0-8d8329fcab9c","shortName":"securin"},"references":[{"name":"TightVNC bug #1658","tags":["issue-tracking"],"url":"https://sourceforge.net/p/vnc-tight/bugs/1658/"},{"name":"TightVNC release notes (2.8.88)","tags":["release-notes","patch"],"url":"https://www.tightvnc.com/whatsnew.php"}],"solutions":[{"lang":"en","value":"Upgrade TightVNC for Windows to version 2.8.88 or later."}],"source":{"discovery":"EXTERNAL"},"timeline":[{"lang":"en","time":"2026-05-30T00:00:00.000Z","value":"Reported to GlavSoft"},{"lang":"en","time":"2026-06-02T00:00:00.000Z","value":"Vendor acknowledged"},{"lang":"en","time":"2026-06-19T00:00:00.000Z","value":"TightVNC 2.8.88 released with fix"}],"title":"World-accessible IPC shared memory with predictable name in TightVNC Server"}},"cveMetadata":{"assignerOrgId":"33c584b5-0579-4c06-b2a0-8d8329fcab9c","assignerShortName":"securin","cveId":"CVE-2026-107612","datePublished":"2026-10-08T13:39:55.702Z","dateReserved":"2026-10-08T13:23:07.677Z","dateUpdated":"2026-10-08T14:02:27.703Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-08 14:16:49","lastModifiedDate":"2026-10-08 15:17:45","problem_types":["CWE-338","CWE-732","CWE-732 CWE-732 Incorrect Permission Assignment for Critical Resource","CWE-338 CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)"],"metrics":{"cvssMetricV31":[{"source":"33c584b5-0579-4c06-b2a0-8d8329fcab9c","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T14:01:50.062814Z","id":"CVE-2026-107612","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"107612","Ordinal":"1","Title":"World-accessible IPC shared memory with predictable name in Tigh","CVE":"CVE-2026-107612","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"107612","Ordinal":"1","NoteData":"Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communication handles used between the TightVNC service and its desktop server process. The named shared memory segment in the Global\\ namespace that carries the pipe HANDLE values is created with a NULL DACL, and its name is derived from a time-seeded srand(time(0)) value that is predictable to one-second granularity. A low-privileged local process can open the mapping and tamper with the IPC channel of a service running as SYSTEM, potentially leading to disclosure of session data, privilege escalation, or denial of service.","Type":"Description","Title":"World-accessible IPC shared memory with predictable name in Tigh"}]}}}