UltraVNC Repeater EUVD-2026-40880

The UltraVNC Repeater must be running on a 32-bit build for the integer overflow to be practically reachable, since on 64-bit builds SIZE_MAX is orders of magnitude larger than the maximum buffer the HTTP receiver can supply (WI_RXBUFSIZE = 153,600 bytes). The repeater HTTP port must be network-reachable by the attacker; no authentication is required per CVSS PR:N. The attacker must send an HTTP request with a URI that approaches the maximum receive buffer size. The overflow is bounded by WI_RXBUFSIZE - limiting the heap write to approximately 153 KB - which prevents arbitrary-length heap corruption and substantially constrains exploitation to availability impact (crash). No special server-side configuration or user interaction is required beyond the repeater's default HTTP listener being active.

The NVD CVSS 3.1 score of 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L accurately captures the network-reachable, zero-authentication attack surface while limiting impact to availability only. No EPSS score was provided in the intelligence data, so exploitation probability cannot be quantified numerically. The CVE is not in CISA KEV, and no POC code was reported, making this a theoretical-risk finding at time of analysis rather than an active threat. The most significant risk-reducing factor is the bounded overflow: because the HTTP receive buffer caps the writable data at approximately 153 KB, an attacker cannot write arbitrary amounts of data past the allocation, which substantially reduces the likelihood of reliable code execution compared to an unbounded heap overflow. The realistic worst-case outcome is a repeater process crash (denial of service), not remote code execution. Risk is further constrained by UltraVNC Repeater's relatively limited deployment footprint compared to mainstream infrastructure software. This is not a 'high-CVSS-but-low-risk' case - the moderate CVSS score appears well-calibrated to the actual, bounded impact.

An attacker with network access to the UltraVNC repeater HTTP port sends an HTTP GET request with a URI string sized close to the 153,600-byte receive buffer limit. The win_log() function passes this URI as the line argument, the sizeof(struct LIST) + strlen(line) addition overflows on a 32-bit build to a small value, malloc returns an undersized chunk, and the subsequent strcpy writes up to approximately 153 KB of attacker-controlled data past the chunk boundary into the heap - most likely corrupting adjacent heap metadata or data structures and crashing the repeater process.