EUVD-2026-40880
GHSA-hpq9-2mqh-7fg9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-reachable HTTP port with no authentication; bounded overflow precludes code execution, limiting impact to partial availability loss only.
Primary rating from Vendor (securin).
CVSS VectorVendor: securin
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
1DescriptionCVE.org
UltraVNC repeater through 1.8.2.2 contains an integer overflow in the HTTP request logging path. In repeater/webgui/settings.c:336, the win_log() function allocates list nodes via malloc(sizeof(struct LIST) + strlen(line)), where line is derived from HTTP request URIs. If strlen(line) is sufficiently large, the addition overflows to a value smaller than sizeof(struct LIST), causing a heap allocation smaller than required. The subsequent strcpy of the full string into the undersized allocation produces a heap buffer overflow. In the current implementation this overflow is bounded by the HTTP receive buffer size (WI_RXBUFSIZE = 153600 bytes, well below SIZE_MAX on 32-bit builds), limiting practical exploitability to a partial heap write. A remote unauthenticated attacker can trigger the theoretical overflow path by sending a maximally-sized URI in an HTTP request to the repeater HTTP port.
AnalysisAI
Heap buffer overflow in UltraVNC Repeater through 1.8.2.2 stems from an integer overflow in the HTTP request logging function win_log(), where a malloc size calculation wraps around on 32-bit builds when processing oversized URIs, producing an undersized heap allocation followed by an unchecked strcpy. Remote unauthenticated attackers can trigger this path by sending a maximally-sized URI to the repeater HTTP port, with practical impact bounded by the 153,600-byte HTTP receive buffer and currently assessed at availability disruption rather than reliable code execution. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Technical ContextAI
UltraVNC is an open-source remote desktop suite for Windows; its repeater component (cpe:2.3:a:uvnc:ultravnc:*:*:*:*:*:*:*:*) functions as a network relay/proxy, exposing an HTTP port for its webgui. The vulnerable code path is in repeater/webgui/settings.c at line 336, where win_log() computes malloc(sizeof(struct LIST) + strlen(line)) with line derived directly from HTTP request URI data. CWE-190 (Integer Overflow or Wraparound) describes the root cause: on 32-bit builds, if strlen(line) approaches SIZE_MAX minus sizeof(struct LIST), the addition wraps to a very small value, causing malloc to return a legitimate but undersized allocation. The subsequent strcpy of the full URI string into this allocation writes beyond the allocation boundary - a classic CWE-122 heap-based buffer overflow as a secondary consequence. Critically, the HTTP receive buffer constant WI_RXBUFSIZE is defined as 153,600 bytes, which is well below SIZE_MAX on 32-bit targets, meaning the maximum overflow write is bounded and cannot be arbitrarily extended by an attacker.
RemediationAI
No vendor-released patch version has been independently confirmed from the available references at time of analysis; users should monitor the UltraVNC vendor site (https://uvnc.com/) and the GitHub repository (https://github.com/ultravnc/UltraVNC) for a release beyond 1.8.2.2 that addresses this issue. As a primary compensating control, restrict network access to the UltraVNC repeater HTTP port using firewall rules or host-based ACLs, limiting reachability to trusted administrative hosts - this eliminates the remote attack surface entirely with no functional trade-off for non-administrative users. If the repeater webgui is not operationally required, disabling the HTTP listener removes the vulnerable code path; note this will prevent browser-based configuration of the repeater. Deploying the repeater in 64-bit mode, where SIZE_MAX far exceeds the receive buffer size, makes the integer overflow condition non-reachable in practice as an additional mitigation pending a patch.
UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in the Repeater Host configuration field that allow
UltraVNC versions up to 1.6.4.0 suffer from an uncontrolled search path vulnerability in version.dll loaded by the Servi
UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in its password configuration properties that allow
UltraVNC revision 1203 has out-of-bounds access vulnerability in VNC client inside RAW decoder, which can potentially re
UltraVNC revision 1211 has multiple improper null termination vulnerabilities in VNC server code, which result in out-of
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer offer handler, w
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer request handler,
UltraVNC revision 1211 has multiple off-by-one vulnerabilities in VNC server code, which can potentially result in code
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer handler, which c
UltraVNC revision 1206 has multiple off-by-one vulnerabilities in VNC client code connected with improper usage of Clien
UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of ClientConnecti
UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of SETPIXELS macr
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today