Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-107613 Details

Description

A NULL pointer dereference vulnerability in the Win8ScreenDriver component of GlavSoft TightVNC Server for Windows before 2.8.88 allows an attacker to crash the server, causing a denial of service. When re-initialization of the DXGI Desktop Duplication driver fails in applyNewScreenProperties() (for example after a GPU reset, display hot-plug or session change), m_drvImpl is left NULL and is subsequently dereferenced without a check by executeDetection(), getScreenBuffer(), grabFb(), getScreenPropertiesChanged() and getCursorPosition().

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: securinCVSS-B:5.9 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://sourceforge.net/p/vnc-tight/bugs/1660/	securin
https://www.tightvnc.com/whatsnew.php	securin

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-476	NULL Pointer Dereference	securin

Affected Products

No affected product data is available for this CVE.

Change History

2 change records found show changes

Date	Action	Recorded By
Oct 8, 2026	CVE Modified	CISA-ADP
Oct 8, 2026	New CVE Received	securin