TightVNC is a remote-access software package with a focused product footprint that nonetheless sits in a sensitive position for system administration and support, making its security posture consequential to many deployed environments. Vulnerabilities affecting the vendor skew strongly toward critical-severity outcomes and have a moderate tendency to acquire public exploit tooling, while the recurring weakness classes center on memory-safety flaws—classic and heap-based buffer overflows, out-of-bounds writes—and improper privilege management that are characteristic of legacy native codebases. Defenders should treat TightVNC advisories as high-priority and prioritize patching of internet-facing or trust-boundary instances; live exploitation activity and severity breakdowns are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Tightvnc over time
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2009-0388HIGH Multiple integer signedness errors in (1) UltraVNC 1.0.2 and 1.0.5 and (2) TightVnc 1.3.9 allow remote VNC servers to cause a denial of service (heap corruption and application cra | Feb 4, 2009 | 10.0 | 41 | NO | YES |
CVE-2019-15678CRITICAL TightVNC code version 1.3.10 contains heap buffer overflow in rfbServerCutText handler, which can potentially result code execution.. This attack appear to be exploitable via netwo | Oct 29, 2019 | 9.8 | 37 | NO | NO |
CVE-2019-15679CRITICAL TightVNC code version 1.3.10 contains heap buffer overflow in InitialiseRFBConnection function, which can potentially result code execution. This attack appear to be exploitable vi | Oct 29, 2019 | 9.8 | 34 | NO | NO |
CVE-2019-8287CRITICAL TightVNC code version 1.3.10 contains global buffer overflow in HandleCoRREBBP macro function, which can potentially result code execution. This attack appear to be exploitable via | Oct 29, 2019 | 9.8 | 33 | NO | NO |
CVE-2021-42785CRITICAL Buffer Overflow vulnerability in tvnviewer.exe of TightVNC Viewer allows a remote attacker to execute arbitrary instructions via a crafted FramebufferUpdate packet from a VNC serve | Nov 23, 2021 | 9.8 | 31 | NO | NO |
CVE-2023-27830CRITICAL TightVNC before v2.8.75 allows attackers to escalate privileges on the host operating system via replacing legitimate files with crafted files when executing a file transfer. This | Apr 12, 2023 | 9.0 | 28 | NO | NO |
CVE-2019-15680HIGH TightVNC code version 1.3.10 contains null pointer dereference in HandleZlibBPP function, which results Denial of System (DoS). This attack appear to be exploitable via network con | Oct 29, 2019 | 7.5 | 23 | NO | NO |
CVE-2002-1336HIGH TightVNC before 1.2.6 generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and respons | Dec 11, 2002 | 7.5 | 21 | NO | NO |
CVE-2002-1511MEDIUM The vncserver wrapper for vnc before 3.3.3r2-21 uses the rand() function instead of srand(), which causes vncserver to generate weak cookies. | Mar 3, 2003 | 5.0 | 15 | NO | NO |
CVE-2002-0971MEDIUM Vulnerability in VNC, TightVNC, and TridiaVNC allows local users to execute arbitrary code as LocalSystem by using the Win32 Messaging System to bypass the VNC GUI and access the " | Sep 24, 2002 | 4.6 | 14 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Tightvnc.
Media articles that mention a CVE ID that affects a product developed by Tightvnc — matched by CVE ID, not by vendor name.