Ultravnc CVE-2026-4962

Requires local access to a system running UltraVNC versions up to 1.6.4.0. Attacker needs low-privilege user account (PR:L). Exploitation targets uncontrolled search path in version.dll Service component with high complexity. No victim interaction required.

Real-world risk is moderate despite the 7.3 CVSS v4.0 score. The CVSS vector indicates local attack vector (AV:L), high attack complexity (AC:H), low privileges required (PR:L), and no user interaction needed (UI:N), with high impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H). Publicly available exploit code exists (linked via Google Drive in references), but the attack is explicitly noted as difficult to execute with high complexity. The requirement for local access significantly reduces the attack surface compared to network-based vulnerabilities. No EPSS score is provided in the intelligence data, and this is not listed in CISA KEV, indicating no confirmed active exploitation campaigns. The vendor's non-responsiveness is concerning for long-term remediation prospects, but the local attack vector and high complexity mean this is not an immediate critical priority for organizations with standard endpoint controls and restricted local access. However, for environments where UltraVNC services run with elevated privileges and local users are untrusted, this warrants attention.

An attacker with low-privileged local access to a Windows system running UltraVNC Service plants a malicious version.dll in a directory that precedes the legitimate library location in the Windows DLL search order, such as the application directory or a user-writable path. When the UltraVNC Service starts or restarts, it loads the attacker's malicious DLL instead of the legitimate one, executing arbitrary code with SYSTEM privileges and granting the attacker full control over the compromised system. Publicly available exploit code exists (accessible via https://drive.google.com/file/d/1QC-MrqGsfjr4phEN77krLFZHQN8S48U_/view), though exploitation is noted as difficult with high complexity, likely requiring specific timing or environmental conditions.