CVE-2026-107615

HIGH 7.8

DLL search order hijacking via screenhooks libraries in TightVNC Server

CVSS Score

7.8

EPSS Score

0.0%

EPSS Percentile

0th

An uncontrolled search path element vulnerability in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to execute arbitrary code with SYSTEM privileges. DynamicLibrary::init() (and ThemeLib) load screenhooks32.dll / screenhooks64.dll with LoadLibrary() using a bare file name and no LOAD_LIBRARY_SEARCH_* flags, so the TightVNC service follows the default DLL search order and loads an attacker-planted DLL from a writable directory earlier in that order (for example, an installation directory with permissive ACLs).

CWE	CWE-427
Vendor	glavsoft
Product	tightvnc
Published	Oct 8, 2026
Last Updated	Oct 8, 2026

Stay Ahead of the Next One

Get instant alerts for glavsoft tightvnc

Be the first to know when new high vulnerabilities affecting glavsoft tightvnc are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

GlavSoft / TightVNC

0 < 2.8.88

References

NVD ↗ CVE.org ↗ EPSS Data ↗

sourceforge.net: https://sourceforge.net/p/vnc-tight/bugs/1666/ tightvnc.com: https://www.tightvnc.com/whatsnew.php

Credits

Arjun Basnet from Securin