CVE-2026-107615 GlavSoft CVE debrief

Who should care

System administrators and security teams responsible for managing and securing TightVNC Server installations should assess exposure and prioritize patching. This includes reviewing the current version of TightVNC Server, identifying potential vulnerabilities, and implementing necessary updates or mitigations. Additionally, security teams should monitor for suspicious activity related to TightVNC Server and review compensating controls for exposed systems.

Why it matters

This vulnerability allows a local authenticated user to execute arbitrary code with SYSTEM privileges, posing a significant risk to systems and data accessed through TightVNC Server.

• Potential code execution with SYSTEM privileges
• Elevation of privileges for local authenticated users
• Possible lateral movement and exploitation

Technical summary

The vulnerability is caused by the TightVNC service loading screenhooks32.dll / screenhooks64.dll using LoadLibrary() with a bare file name and no LOAD_LIBRARY_SEARCH_* flags, allowing an attacker to plant a malicious DLL in a writable directory earlier in the DLL search order. This can lead to arbitrary code execution with SYSTEM privileges. The affected product is TightVNC Server for Windows before version 2.8.88. The vulnerability has a CVSS score of 7.8 and is classified as HIGH severity. The CVE record was published on 2026-10-08T13:39:59.358Z.

Defensive priority

High-priority patching and verification recommended for TightVNC Server installations.

Recommended defensive actions

• Patch TightVNC Server to version 2.8.88 or later
• Verify TightVNC Server installations for exposure
• Monitor for suspicious activity related to TightVNC Server
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the TightVNC service loading screenhooks32.dll / screenhooks64.dll using LoadLibrary() with a bare file name and no LOAD_LIBRARY_SEARCH_* flags, allowing an attacker to plant a malicious DLL in a writable directory earlier in the DLL search order.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.