EUVD-2026-40881
GHSA-fxj2-5q9g-wmp9
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable web GUI (AV:N) with a deterministic overflow (AC:L), but admin login is mandatory (PR:H) and no user interaction; code execution yields full C:H/I:H/A:H on the host.
Primary rating from Vendor (securin).
CVSS VectorVendor: securin
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In repeater/webgui/settings.c:225-272, after strncpy_s copies a rule token into temp1[rule1] (25-byte destination) or temp2/temp3 (16-byte destination), the code unconditionally writes a NUL terminator at temp1[rule1][len] = 0 without clamping len to the destination size. When an authenticated administrator saves a rule with a token length equal to or greater than the destination size, the NUL byte is written one or more bytes past the end of the stack-allocated array, corrupting adjacent stack data. An attacker who has obtained admin credentials (including via CVE-2026-7839 default password) can trigger this to gain code execution on the repeater host.
AnalysisAI
Remote code execution in the UltraVNC Repeater (through version 1.8.2.2) allows an authenticated administrator to corrupt stack memory via the web GUI allow/deny rule parser, ultimately achieving code execution on the repeater host. The flaw (CWE-787, out-of-bounds write) is reachable only after admin login, but that barrier is significantly weakened when chained with CVE-2026-7839 (default password), which can hand an attacker the required credentials. There is no public exploit identified at time of analysis and no EPSS/KEV data supplied, so this is currently a credentialed, chainable RCE rather than a confirmed mass-exploited threat.
Technical ContextAI
UltraVNC Repeater is a relay/proxy component of the UltraVNC remote-desktop suite, used to broker VNC connections between viewers and servers across NAT boundaries; its web GUI (webgui/settings.c) manages IP allow/deny rules. The root cause is a classic CWE-787 out-of-bounds write: at settings.c:225-272, after strncpy_s copies a rule token into fixed stack buffers (temp1[rule1] is 25 bytes; temp2/temp3 are 16 bytes), the code unconditionally executes temp1[rule1][len] = 0 to NUL-terminate without clamping len to the buffer size. When the token length equals or exceeds the destination size, the terminator lands one or more bytes past the array end, corrupting adjacent stack data (potentially saved registers, frame pointers, or return addresses) and creating a memory-corruption primitive that can be escalated to control flow hijack.
RemediationAI
No vendor-released patch version was identified at time of analysis; the referenced advisory link (https://uvnc.com/) is the vendor homepage rather than a fixed-release note, so administrators should check https://uvnc.com/ and https://github.com/ultravnc/UltraVNC for a release above 1.8.2.2 and upgrade as soon as one is confirmed. Until a patched build is available, the highest-value compensating control is to eliminate the credential-chaining path from CVE-2026-7839 by changing the repeater admin password away from any default and enforcing a strong password, since exploitation requires admin authentication (PR:H). Additionally, restrict network access to the repeater web GUI management interface to trusted management hosts only (firewall/ACL to the GUI port), or disable the web GUI entirely if rules are managed by other means, and avoid saving allow/deny rule tokens at or beyond the 25-byte (temp1) / 16-byte (temp2/temp3) buffer limits. The trade-off of locking down the web GUI is reduced remote manageability of allow/deny rules; the trade-off of disabling it is loss of browser-based configuration.
UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in the Repeater Host configuration field that allow
UltraVNC versions up to 1.6.4.0 suffer from an uncontrolled search path vulnerability in version.dll loaded by the Servi
UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in its password configuration properties that allow
UltraVNC revision 1203 has out-of-bounds access vulnerability in VNC client inside RAW decoder, which can potentially re
UltraVNC revision 1211 has multiple improper null termination vulnerabilities in VNC server code, which result in out-of
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer offer handler, w
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer request handler,
UltraVNC revision 1211 has multiple off-by-one vulnerabilities in VNC server code, which can potentially result in code
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer handler, which c
UltraVNC revision 1206 has multiple off-by-one vulnerabilities in VNC client code connected with improper usage of Clien
UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of ClientConnecti
UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of SETPIXELS macr
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today