EUVD-2026-40878
GHSA-f9fh-23qv-g394
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
AC:H reflects the abnormal caller contract prerequisite; C:L added because adjacent memory disclosure is described as a realistic (if unreliable) outcome, overriding the vendor's C:N.
Primary rating from Vendor (securin).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Lifecycle Timeline
2DescriptionNVD
UltraVNC through 1.8.2.2 contains an out-of-bounds read in the wide-string to multibyte conversion helper. In rfb/dh.cpp:204, the vncWc2Mb() function passes a caller-supplied WCHAR pointer to wcslen() before any bounds check. If the caller provides a wide-character buffer that is not properly NUL-terminated, wcslen() reads past the end of the buffer until it encounters a NUL wchar, resulting in an out-of-bounds read. Under typical Win32 API usage this requires an abnormal caller contract. Impact is limited to a potential information disclosure from adjacent memory regions or a process crash (denial of service) if the over-read crosses a page boundary.
AnalysisAI
Out-of-bounds read in UltraVNC through version 1.8.2.2 allows network-authenticated attackers to potentially crash the VNC server process or leak adjacent memory content via the vncWc2Mb() wide-string conversion helper in rfb/dh.cpp at line 204. The flaw is triggered when wcslen() is called on a caller-supplied WCHAR pointer without a preceding bounds check, enabling memory over-reads if the buffer lacks proper NUL termination. No public exploit code or active exploitation has been identified at time of analysis; the vendor's CVSS 4.3 (Medium) rating reflects the constrained and largely denial-of-service-oriented impact.
Technical ContextAI
The vulnerability is a CWE-125 (Out-of-Bounds Read) in the vncWc2Mb() function, a wide-character to multibyte string conversion helper located in rfb/dh.cpp at line 204 of the UltraVNC codebase. The rfb/ path prefix indicates this code resides within the Remote Framebuffer protocol implementation. The function calls the Win32/POSIX wcslen() API on a caller-supplied WCHAR pointer before performing any bounds validation. Since wcslen() scans forward in memory until it encounters a null wide-character (0x0000), passing a buffer that is not properly NUL-terminated causes the function to read beyond the allocated buffer boundary into adjacent memory. Per CPE cpe:2.3:a:uvnc:ultravnc:*:*:*:*:*:*:*:*, all UltraVNC versions through 1.8.2.2 are affected. The Win32 API context (WCHAR, wcslen) confirms this is exclusively a Windows platform issue. The root class - trusting caller-supplied pointer length without validation - is a classic input validation failure at an internal API boundary.
RemediationAI
Monitor the UltraVNC vendor site at https://uvnc.com/ and the upstream GitHub repository at https://github.com/ultravnc/UltraVNC for a patched release beyond version 1.8.2.2. No confirmed fixed version is available in the provided intelligence, so a vendor-released patch has not been independently verified at time of analysis. As an immediate compensating control, restrict network access to VNC services via host-based firewall rules or require VPN tunneling before VNC is reachable - this eliminates the network attack vector (AV:N) without disabling VNC functionality, with the trade-off of added infrastructure overhead. Enforcing strong authentication credentials for VNC sessions addresses the PR:L prerequisite by raising the barrier to obtaining valid access. Organizations should subscribe to release notifications on the UltraVNC GitHub repository to be alerted when a patched version is published.
UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in the Repeater Host configuration field that allow
UltraVNC versions up to 1.6.4.0 suffer from an uncontrolled search path vulnerability in version.dll loaded by the Servi
UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in its password configuration properties that allow
UltraVNC revision 1203 has out-of-bounds access vulnerability in VNC client inside RAW decoder, which can potentially re
UltraVNC revision 1211 has multiple improper null termination vulnerabilities in VNC server code, which result in out-of
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer offer handler, w
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer request handler,
UltraVNC revision 1211 has multiple off-by-one vulnerabilities in VNC server code, which can potentially result in code
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer handler, which c
UltraVNC revision 1206 has multiple off-by-one vulnerabilities in VNC client code connected with improper usage of Clien
UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of ClientConnecti
UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of SETPIXELS macr
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today