CVE-2026-128321None▾ SunlitTight JPEG decoding in TightVNC and UltraVNC viewers contains a heap-based buffer overflow because an attacker-controlled framebuffer rectangle width is not validated against a fixed-size decoding buffer. A malicious VNC server can cause…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Tight JPEG decoding in TightVNC and UltraVNC viewers contains a heap-based buffer overflow because an attacker-controlled framebuffer rectangle width is not validated against a fixed-size decoding buffer. A malicious VNC server can cause an out-of-bounds heap write when a user connects, resulting in application crash and potentially other memory-corruption impacts.
UltraVNC >= 1.8.2.4 <= 1.8.2.6TightVNC >= 1.3.10 <= 1.3.10Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-15059High· 7.8GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
CVE-2025-10935High· 7.8libilbm ILBM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
CVE-2023-3428Medium· 6.2Imagemagick: heap-buffer-overflow in coders/tiff.c
CVE-2023-43787High· 7.8Libx11: integer overflow in xcreateimage() leading to a heap overflow
CVE-2023-52356High· 7.5Libtiff: segment fault in libtiff in tiffreadrgbatileext() leading to denial of service
CVE-2024-56826Medium· 5.6Openjpeg: heap buffer overflow in bin/common/color.c