EUVD-2026-40877
GHSA-gh7j-9w79-xm55
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Web GUI is network-reachable with no auth required to submit credentials, but AC:H reflects the exact-length crafting requirement and current HTTP-layer constraint blocking practical exploitation.
Primary rating from Vendor (securin).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
1DescriptionNVD
UltraVNC repeater through 1.8.2.2 contains an off-by-one error in the Base64 decode helper used for HTTP Basic authentication. In repeater/webgui/webutils.c:817, the wi_uudecode() function checks whether the input length exceeds the output buffer with a strict greater-than comparison (>), while the correct check should be greater-than-or-equal (>=). When strlen(authdata) equals sizeof(decode), the decoded output length (approximately 3/4 of input) does not overflow the buffer in current practice because the outer HTTP request bounds constrain the Authorization header. However, the defective check leaves a latent off-by-one condition that could become exploitable if the buffering constraints change. The current risk is limited to a one-byte write at the boundary of a 1024-byte stack buffer under constrained conditions.
AnalysisAI
UltraVNC Repeater through 1.8.2.2 harbors a latent off-by-one stack buffer boundary condition in its HTTP Basic authentication Base64 decoder, where a strict greater-than comparison at repeater/webgui/webutils.c:817 fails to block an input whose length exactly equals the 1024-byte output buffer. Under current code, the outer HTTP request parser incidentally caps Authorization header length before the defect can produce an out-of-bounds write, making this vulnerability practically unexploitable in its present form - but the flaw is real and would become a one-byte stack write if upstream buffering constraints change. No public exploit code exists and the vulnerability is not listed in CISA KEV; this is a latent memory-safety defect requiring patch application as hygiene rather than urgent incident response.
Technical ContextAI
UltraVNC Repeater is a relay proxy component that brokers VNC connections through NAT and firewalls, distinct from the UltraVNC viewer and server; it exposes an embedded web management GUI that supports HTTP Basic authentication. The root cause is CWE-193 (Off-by-One Error): in wi_uudecode(), the boundary guard strlen(authdata) > sizeof(decode) should be strlen(authdata) >= sizeof(decode). When the Authorization header's Base64 payload is exactly sizeof(decode) bytes, the decoder proceeds without rejection; because Base64 decodes at roughly 3/4 ratio, the decoded bytes nominally fit within the 1024-byte stack buffer, but the fence-post error leaves one byte at the buffer boundary unprotected. The CPE string cpe:2.3:a:uvnc:ultravnc:*:*:*:*:*:*:*:* indicates all UltraVNC versions through 1.8.2.2 are in scope for this component. The defect was reported by Securin and is traceable to a single comparison operator in the web GUI utility code.
RemediationAI
Upgrade UltraVNC Repeater to a version that applies the one-character fix (changing > to >= at repeater/webgui/webutils.c:817) once a patched release is published; monitor the vendor advisory at https://uvnc.com/ and the upstream repository at https://github.com/ultravnc/UltraVNC for a confirmed fixed version number, which is not independently verifiable from currently available data. As a compensating control, firewall or ACL-restrict network access to the UltraVNC Repeater's HTTP management GUI port to trusted administrative hosts only - this eliminates network reachability of the vulnerable authentication endpoint without requiring an application change. If the web GUI is not operationally required, disabling it entirely removes the attack surface for this flaw; the trade-off is loss of browser-based management access. No other compensating controls are needed given the constrained, availability-only nature of the current risk.
UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in the Repeater Host configuration field that allow
UltraVNC versions up to 1.6.4.0 suffer from an uncontrolled search path vulnerability in version.dll loaded by the Servi
UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in its password configuration properties that allow
UltraVNC revision 1203 has out-of-bounds access vulnerability in VNC client inside RAW decoder, which can potentially re
UltraVNC revision 1211 has multiple improper null termination vulnerabilities in VNC server code, which result in out-of
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer offer handler, w
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer request handler,
UltraVNC revision 1211 has multiple off-by-one vulnerabilities in VNC server code, which can potentially result in code
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer handler, which c
UltraVNC revision 1206 has multiple off-by-one vulnerabilities in VNC client code connected with improper usage of Clien
UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of ClientConnecti
UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of SETPIXELS macr
Same weakness CWE-193 – Off-by-one Error
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today