EUVD-2026-40886
GHSA-95qw-xpp9-h343
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Pre-auth, network-reachable overflow triggered by a single oversized URI gives AV:N/AC:L/PR:N/UI:N; attacker-controlled code execution yields C:H/I:H/A:H with scope unchanged.
Primary rating from Vendor (securin).
CVSS VectorVendor: securin
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embedded HTTP administration server. The functions wi_senderr() and wi_replyhdr() in repeater/webgui/webutils.c write the caller-supplied HTTP request URI into a fixed 1000-byte global buffer (hdrbuf) via unchecked sprintf calls. The HTTP receive buffer accepts URIs up to approximately 150 KB (WI_RXBUFSIZE = 153600), so an unauthenticated attacker who can reach the repeater HTTP port (default TCP 80) can overflow hdrbuf by at least 500 bytes with a single HTTP request containing a URI of 1500 bytes or longer, corrupting adjacent .bss-segment globals. The overflow occurs before any authentication check, making it reachable without credentials. A remote, unauthenticated attacker can achieve arbitrary code execution on the host running the repeater.
AnalysisAI
Remote code execution in the UltraVNC repeater (through version 1.8.2.2) allows an unauthenticated attacker who can reach the built-in HTTP administration port (default TCP 80) to overflow a fixed 1000-byte global buffer and corrupt adjacent .bss globals, leading to arbitrary code execution on the host. The flaw lives in wi_senderr() and wi_replyhdr() in repeater/webgui/webutils.c, where the request URI is copied via unchecked sprintf before any authentication check runs. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.3 combined with pre-auth network reachability makes this a high-priority issue.
Technical ContextAI
UltraVNC is a Windows remote-access suite; its repeater component relays VNC sessions between viewers and servers that cannot connect to each other directly, and it ships an embedded HTTP web GUI for administration. The vulnerability is a classic CWE-787 out-of-bounds write: the HTTP receive buffer WI_RXBUFSIZE is 153600 bytes (~150 KB) and accepts very long request URIs, but the response-header helpers wi_senderr() and wi_replyhdr() format that attacker-controlled URI into a fixed 1000-byte global buffer (hdrbuf) using sprintf with no bounds checking. A URI of 1500+ bytes overwrites hdrbuf by at least 500 bytes, spilling into adjacent globals in the .bss segment. Because hdrbuf is a global (not stack) object, this is a global/BSS overflow that corrupts neighboring program state rather than overwriting a return address directly, but the write primitive is attacker-controlled and reachable pre-authentication. The affected CPE is cpe:2.3:a:uvnc:ultravnc:*:*:*:*:*:*:*:* .
RemediationAI
No vendor-released patch identified at time of analysis; the references (https://uvnc.com/ and https://github.com/ultravnc/UltraVNC) do not cite a specific fixed version, so monitor those sources for a release that corrects the unchecked sprintf calls in repeater/webgui/webutils.c. As the primary compensating control, restrict network reachability of the repeater's HTTP administration port (default TCP 80) by binding it to localhost or an isolated management VLAN and blocking it at the perimeter and host firewall so only trusted admin hosts can reach it; the side effect is that legitimate remote web-GUI administration must then go through a bastion host or VPN. If the web GUI is not required, disable the embedded HTTP administration server entirely, which removes the attack surface at the cost of losing browser-based management. As a stopgap, place the repeater behind a reverse proxy or WAF that rejects HTTP requests with abnormally long URIs (for example, cap URI length well under 1000 bytes), which blocks the specific overflow trigger without affecting normal relay traffic on the VNC ports.
UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in the Repeater Host configuration field that allow
UltraVNC versions up to 1.6.4.0 suffer from an uncontrolled search path vulnerability in version.dll loaded by the Servi
UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in its password configuration properties that allow
UltraVNC revision 1203 has out-of-bounds access vulnerability in VNC client inside RAW decoder, which can potentially re
UltraVNC revision 1211 has multiple improper null termination vulnerabilities in VNC server code, which result in out-of
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer offer handler, w
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer request handler,
UltraVNC revision 1211 has multiple off-by-one vulnerabilities in VNC server code, which can potentially result in code
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer handler, which c
UltraVNC revision 1206 has multiple off-by-one vulnerabilities in VNC client code connected with improper usage of Clien
UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of ClientConnecti
UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of SETPIXELS macr
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today