EUVD-2026-40883
GHSA-38w7-mq68-3h8q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessStand up malicious VNC server
-
DeliveryLure victim to connect viewer
-
ExploitSend ServerInit with name length 2024
-
ExecutionReadString writes NUL at _dn[2024]
-
PersistOff-by-one corrupts stack
-
ImpactViewer process crashes (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Off-by-one prevention
|
| Exploitation Conditions | Exploitation requires the victim to actively connect their UltraVNC viewer (<=1.8.2.2) to an attacker-controlled or compromised VNC server; it cannot be triggered against a viewer that never initiates a session. The specific trigger is a server-sent RFB ServerInit message advertising a desktop name of exactly length 2024, which drives the off-by-one NUL write in ClientConnection.cpp. Limiting factors: required user interaction (the outbound connection, UI:R), the impact being predominantly denial of service rather than reliable code execution, and mitigation on builds compiled with /GS stack protection where the corrupted canary forces a clean process termination. No attacker authentication or victim-side privilege is needed on the server side (PR:N). |
| Impact | This is a client-side, server-triggered flaw: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H, base 7.5) captures that no attacker-side privileges are needed but the victim must connect (UI:R), and that the dominant, reliable impact is availability (A:H) via process crash. The single-byte NUL overwrite makes reliable code execution unlikely; the C:L/I:L ratings are optimistic given the primitive is one out-of-bounds NUL, so the realistic outcome is denial of service rather than compromise. No EPSS score, KEV entry, or POC was supplied, so probability-of-exploitation signals are absent; the practical bar is that a target must be lured into connecting to a hostile server, which limits mass exploitation and favors targeted or social-engineering-driven scenarios. Net: a genuine but moderate-priority issue - real crash risk for users of untrusted/redirected VNC servers, not an internet-facing worm-class threat. Note the conflict worth verifying: the vector implies confidentiality/integrity impact, but the described single-NUL primitive predominantly supports DoS. |
| Exploit ScenarioDerived | An attacker stands up a malicious VNC server (or hijacks/redirects a legitimate connection) that emits a ServerInit message declaring a desktop name of exactly 2024 bytes. When a victim points their UltraVNC viewer (<=1.8.2.2) at that server, ReadString writes a NUL one byte past _dn[2024], crashing the viewer on /GS builds or corrupting adjacent stack memory otherwise. No public POC is referenced, and the AC:L/UI:R profile means the only real hurdle is convincing the user to connect. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 01, 2026
Denial of service in the UltraVNC viewer (vncviewer) through 1.8.2.2 arises from an off-by-one stack buffer overflow in the RFB ServerInit message handler, where a malicious VNC server advertising a desktop name of exactly 2024 bytes forces ReadString to write a NUL terminator at _dn[2024], one byte past a 2024-byte stack buffer. A rogue or compromised server can crash victims who connect to it (reliable process termination on /GS-hardened builds) and potentially corrupt adjacent stack data on canary-less release builds. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; exploitation requires the victim to initiate a connection to the attacker-controlled server.
RemediationAI
No vendor-released patch version is identified in the provided data - monitor the vendor site https://uvnc.com/ and the source repository https://github.com/ultravnc/UltraVNC for a release above 1.8.2.2 that corrects the ServerInit name-length handling, and upgrade to that build once published (do not rely on an assumed version number). As a compensating control, only connect the UltraVNC viewer to trusted, known-good servers and avoid clicking VNC links or connection files from untrusted sources, since exploitation requires the victim to initiate the connection; this restricts convenience but eliminates the attack surface. Where feasible, run the viewer on /GS-protected builds so the overflow deterministically terminates the process (a controlled crash) rather than silently corrupting adjacent stack data on canary-less release builds, and restrict outbound VNC (typically TCP 5900/5800) to approved server endpoints via host or network firewall to prevent connections to rogue servers.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
UltraVNC is a Windows remote-access suite implementing the RFB (Remote Framebuffer) protocol used by VNC. During session setup, the server sends a ServerInit message containing a name-length field followed by the desktop name string. In vncviewer/ClientConnection.cpp the client trusts the server-supplied nameLength: when it equals 2024 it stack-allocates _dn[2024] and calls ReadString(_dn, 2024), but ReadString appends a NUL terminator at buf[length] - index 2024 - writing one byte beyond the buffer. This is a classic CWE-193 (Off-by-One Error) boundary miscalculation, where the terminator is not accounted for in the buffer sizing. The affected CPE is cpe:2.3:a:uvnc:ultravnc:*:*:*:*:*:*:*:*, covering the UltraVNC application family up to and including 1.8.2.2.
Know when Ultravnc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Attacker-controlled server needs no privileges (PR:N) but victim must connect (UI:R); single-NUL primitive yields reliable DoS (A:H) and minor integrity impact, no realistic confidentiality leak (C:N).
Primary rating from Vendor (securin).
CVSS VectorVendor: securin
Lifecycle Timeline
1DescriptionCVE.org
UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message handler. In vncviewer/ClientConnection.cpp, when the server-supplied nameLength equals exactly 2024 the code declares a 2024-byte stack buffer _dn[2024] and calls ReadString(_dn, 2024). ReadString writes the NUL terminator at buf[length], i.e., _dn[2024], one byte past the end of the stack buffer. A malicious VNC server can trigger this condition by advertising a desktop name of length 2024 in its ServerInit message. On release builds without stack canaries the single-byte NUL overwrite adjacent stack data. On builds with /GS stack protection the canary is corrupted and the process terminates, resulting in denial of service. User interaction (connecting the viewer to the malicious server) is required.
Executive ViewAI
UltraVNC viewer versions 1.8.2.2 and earlier contain a stack buffer overflow vulnerability triggered when users connect to a malicious VNC server, causing application crashes and directly impacting remote support operations and business continuity. No public exploit has been identified at time of analysis; however, no vendor-released patch is available, requiring immediate system inventory and interim security controls to reduce exposure risk. The vulnerability creates a denial-of-service threat for organizations dependent on remote desktop access for critical support functions.
No vendor-released patch identified at time of analysis. Restrict UltraVNC outbound connections to whitelisted internal VNC servers via firewall policy and network segmentation to limit exposure to malicious servers. Disable UltraVNC on systems where remote access is not operationally required. Implement comprehensive logging and monitoring of VNC connections to detect suspicious activity. Conduct user training emphasizing connection only to pre-authorized, known VNC servers within trusted network zones. Deploy network access controls (ACLs, proxies) at the boundary to enforce VNC server whitelisting.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in UltraVNC Memory Corruption and Cryptographic Flaws
View all 10UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in the Repeater Host configuration field that allow
UltraVNC versions up to 1.6.4.0 suffer from an uncontrolled search path vulnerability in version.dll loaded by the Servi
UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in its password configuration properties that allow
UltraVNC revision 1203 has out-of-bounds access vulnerability in VNC client inside RAW decoder, which can potentially re
UltraVNC revision 1211 has multiple improper null termination vulnerabilities in VNC server code, which result in out-of
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer offer handler, w
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer request handler,
UltraVNC revision 1211 has multiple off-by-one vulnerabilities in VNC server code, which can potentially result in code
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer handler, which c
UltraVNC revision 1206 has multiple off-by-one vulnerabilities in VNC client code connected with improper usage of Clien
UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of ClientConnecti
UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of SETPIXELS macr
Exploit-DB