UltraVNC EUVD-2026-40878

Exploitation requires possession of valid VNC authentication credentials - the CVSS PR:L metric confirms low-privilege authenticated access is a prerequisite before the vulnerable vncWc2Mb() function can be reached. Beyond authentication, the attacker must supply a WCHAR buffer that is not properly NUL-terminated, which the description explicitly characterizes as an 'abnormal caller contract under typical Win32 API usage,' meaning standard VNC client implementations would not naturally produce this condition; a specially crafted or modified client is necessary. Exploitation is further restricted to Windows deployments only due to Win32 API and WCHAR dependencies. Reliable information disclosure is additionally constrained by the need for favorable process memory layout - the more consistent outcome is a denial-of-service crash if the over-read crosses a page boundary. Unauthenticated or remote-without-credentials exploitation is not supported by the available CVSS data.

The official CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, score 4.3) places this at Medium severity with network reachability and a low-privilege requirement. A notable discrepancy exists: the vector assigns C:N (no confidentiality impact) while the CVE description explicitly states 'potential information disclosure from adjacent memory regions' - this conflict likely reflects the vendor's conservative assessment that reliable, controlled information disclosure is not achievable in practice. Additionally, the AC:L assignment appears optimistic given the description's characterization of exploitation as requiring 'an abnormal caller contract under typical Win32 API usage,' which more accurately maps to AC:H. No EPSS data, KEV listing, or public POC was included in the provided intelligence, all of which are absent signals pointing to low real-world exploitation likelihood. The realistic risk profile is routine patching priority: denial of service via process crash is the most consistent outcome, while meaningful memory disclosure would require adversary control over memory layout. This is not an emergency-response scenario.

An attacker with valid VNC credentials authenticates to an UltraVNC server and sends a crafted RFB protocol message containing a wide-character string field that lacks proper NUL termination, causing the server's vncWc2Mb() function to invoke wcslen() past the buffer boundary. Depending on memory layout at the time of the over-read, the outcome is either a server process crash when the read crosses a page boundary (denial of service) or silent consumption of adjacent memory content until a null wide-character is encountered. No public exploit code is known at time of analysis, and reliable targeting of the information disclosure variant would require substantial knowledge of the server process's memory layout.