UltraVNC CVE-2026-44040

Exploitation requires that the attacker be able to passively observe the VNC RFB authentication exchange over the network - specifically, the 16-byte challenge transmitted in cleartext during the VNC security handshake. The attacker must occupy a network position enabling traffic capture (e.g., same broadcast domain, man-in-the-middle, or network tap). No authentication or prior credentials are required to initiate the VNC connection and observe the challenge. The vulnerability is confirmed in the rfb/vncauth.c code path; on Windows, whether shipped UltraVNC binaries invoke this path or the CryptGenRandom-backed vncEncryptBytes2.cpp is under investigation and cannot be confirmed from available data. Exploitation is limited by: (1) the requirement to capture a live authentication challenge exchange before the seed window expires, (2) the possibility that Windows deployments are unaffected if CryptGenRandom is the active path, and (3) the time-bounded nature of seed enumeration relative to a specific observed timestamp.

The NVD-assigned CVSS vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N scores 4.8 (Medium), with AC:H reflecting the attacker's need to observe the authentication exchange and enumerate the seed space under timing constraints. The C:L/I:L impact scores appear to underestimate actual impact: successful VNC authentication bypass yields full desktop visibility and control, which would more accurately warrant C:H/I:H. No EPSS data was supplied, and the CVE is absent from the CISA KEV catalog, consistent with no confirmed active exploitation. No public exploit code has been identified at time of analysis. However, the 31-bit seed space is enumerable on commodity hardware within seconds, and the attack requires only passive network observation - not active tampering. The most significant risk moderator is the unresolved Windows code path: UltraVNC's primary deployment base is Windows, and if CryptGenRandom is actually invoked in shipped Windows binaries, real-world exploitability may be confined to Linux or non-default build configurations. Risk should be treated as moderate-to-high on confirmed vulnerable platforms pending clarification of the Windows compile graph.

An attacker with visibility into VNC network traffic - via a compromised network segment, ARP spoofing, or a tap - captures the 16-byte RFB challenge transmitted in cleartext during a legitimate VNC login attempt. Using the known seed formula (time(0) + getpid() + rand()), the attacker enumerates approximately 2 billion seed candidates on commodity hardware, reconstructs the nonce, and submits a forged authentication response to establish an unauthorized VNC session. No public exploit code has been identified at time of analysis, but the algorithm is well within reach of any researcher familiar with CWE-338 exploitation techniques.