CVE-2021-42785

The flaw is on the client side: TightVNC Viewer (tvnviewer.exe) has a buffer overflow in how it parses a FramebufferUpdate packet, so a malicious VNC server can send a crafted packet that overflows a buffer in the connecting viewer and executes arbitrary code. The direction of attack is the notable part — it's not the server that gets popped, it's the person who connects out to a hostile or compromised VNC server.

That inversion changes the threat model. The victim has to initiate a connection to an attacker-controlled server, so the realistic scenarios are luring someone to connect to a rogue endpoint, or a legitimate VNC server being compromised and then turned against every client that connects to it. Admins and support staff who VNC into many hosts are the natural targets, and because it's client-side, the code runs on their workstation — often a privileged jump box. It's not internet-mass-exploitable in the server-scan sense, but a compromised-server-attacks-clients pattern is a proven way to move onto operator machines.

Our angle is to think about it as a client/endpoint risk and consider chaining. Wherever TightVNC Viewer is used — especially on administrator jump hosts — we'd track it as an endpoint software item to update, since patching the viewer removes the exposure regardless of which servers it talks to. We'd rank it higher for privileged support staff whose workstations are high-value, and note the nasty chain: an attacker who compromises one VNC server can use this to harvest the admins who connect to it.