UltraVNC Repeater CVE-2026-44042

Exploitation requires network-level access to the UltraVNC Repeater's embedded HTTP web GUI management interface and the ability to send a crafted HTTP Basic authentication request with a Base64-encoded Authorization header payload whose raw length equals exactly sizeof(decode) (1024 bytes). The decisive limiting factor is that the current UltraVNC Repeater HTTP request parser itself bounds the Authorization header length below the threshold needed to trigger the off-by-one condition in wi_uudecode() - meaning exploitation is currently blocked by coincidental upstream buffering behavior within the same codebase, not by an intentional security control. Deployments that firewall the web GUI management port or disable the web GUI feature are fully insulated from this vector. The flaw is specific to the HTTP Basic authentication code path in the Repeater component; VNC protocol traffic and non-web-GUI authentication paths are not affected.

The vendor-assigned CVSS 3.1 score of 3.7 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L is well-calibrated for the actual vulnerability: network-reachable via the web GUI (AV:N), but high attack complexity (AC:H) correctly captures the requirement for exact-length crafting plus the dependency on removing the incidental HTTP-layer constraint. No EPSS data was supplied in the input, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is absent from CISA KEV, confirming no known active exploitation. No POC is identified. The description explicitly states the defect is 'latent' and that 'current risk is limited' - this is an honest characterization from the reporter. Real-world prioritization should treat this as a low-urgency patch item: the flaw is real but the exploitation path is currently blocked by coincidental HTTP-layer behavior, and availability-only impact (A:L) with no confidentiality or integrity consequence further limits business risk. The primary concern is code hygiene and preventing future refactoring from accidentally removing the constraining buffer behavior.

An attacker with network access to the UltraVNC Repeater web GUI constructs an HTTP GET or POST request with a Base64-encoded Authorization header payload crafted to be exactly sizeof(decode) (1024) bytes, which bypasses the defective > check in wi_uudecode() and causes the decoder to process a boundary-length input. Under the current codebase, the HTTP request layer's own input handling prevents the Authorization value from reaching the necessary size, blocking practical exploitation - but a hypothetical future refactor removing that constraint could enable a one-byte stack write that may cause a service crash. No public POC is known at time of analysis.