{"id":"CVE-2026-128321","title":"Tight JPEG decoding in TightVNC and UltraVNC viewers contains a heap-based buffer overflow vulnerability","summary":"Tight JPEG decoding in TightVNC and UltraVNC viewers contains a heap-based buffer overflow because an attacker-controlled framebuffer rectangle width is not validated against a fixed-size decoding buffer. A malicious VNC server can cause…","severity":"none","cwe":["CWE-122"],"vendor":"UltraVNC","product":"UltraVNC","affected":["UltraVNC >= 1.8.2.4 <= 1.8.2.6","TightVNC >= 1.3.10 <= 1.3.10"],"published":"2026-11-13","updated":"2026-11-13","sourceUpdated":"2026-11-13T02:05:51.969Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-128321","references":[{"url":"https://www.tightvnc.com/"},{"url":"https://github.com/ultravnc/ultravnc"}],"tags":["cve.org"],"ingestedAt":"2026-11-13T01:19:02.081Z","slug":"CVE-2026-128321","body":"## Overview\n\nTight JPEG decoding in TightVNC and UltraVNC viewers contains a heap-based buffer overflow because an attacker-controlled framebuffer rectangle width is not validated against a fixed-size decoding buffer. A malicious VNC server can cause an out-of-bounds heap write when a user connects, resulting in application crash and potentially other memory-corruption impacts.\n\n## Affected\n\n- `UltraVNC >= 1.8.2.4 <= 1.8.2.6`\n- `TightVNC >= 1.3.10 <= 1.3.10`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}