EUVD-2026-40881
GHSA-fxj2-5q9g-wmp9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain repeater admin credentials (e.g. default password)
-
DeliveryLog into web GUI management interface
-
ExploitSave allow/deny rule with oversized token
-
ExecutionTrigger out-of-bounds NUL write in settings.c parser
-
PersistCorrupt adjacent stack data
-
ImpactAchieve code execution on repeater host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires authenticated administrator access to the UltraVNC Repeater web GUI (CVSS PR:H) and the ability to save an allow/deny rule whose token length is equal to or greater than the destination buffer size - 25 bytes for temp1[rule1] or 16 bytes for temp2/temp3 in webgui/settings.c. The specific trigger feature is the allow/deny (IP filter) rule save operation; a token shorter than the buffer will not overflow. Limiting factors: the attacker must already hold valid admin credentials and the web GUI must be reachable and enabled. This admin barrier is the key mitigating condition, but it is substantially lowered where the repeater still uses the default password (CVE-2026-7839), effectively converting the prerequisite into a known-credential login. |
| Impact | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 High) is internally consistent with the description: network-reachable web GUI, low complexity, but high privileges (admin) required, with full C/I/A impact from code execution. The PR:H requirement is the dominant mitigating factor and keeps this out of 'critical/wormable' territory - a lone attacker needs valid admin credentials first. However, the description explicitly notes those credentials can be obtained via CVE-2026-7839 (default password), which materially raises real-world risk by collapsing the authentication barrier on unhardened deployments. No EPSS score, KEV status, or POC was provided in the intelligence, so exploitation probability cannot be quantified; the absence of these signals should be treated as 'unknown,' not 'low.' Net: a genuine priority for any repeater still using default/weak admin passwords, and a lower-urgency (but still High) patch item for hardened deployments. |
| Exploit ScenarioDerived | An attacker first obtains repeater admin access - for example by logging in with the default password (CVE-2026-7839) - then opens the web GUI and saves an allow/deny rule whose token is crafted to meet or exceed the 25- or 16-byte buffer size. The out-of-bounds NUL write corrupts adjacent stack data and, with a suitably arranged payload, is escalated to arbitrary code execution on the repeater host. No public exploit code was identified at time of analysis, but the primitive is deterministic and low-complexity (AC:L) once authenticated. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 01, 2026
Remote code execution in the UltraVNC Repeater (through version 1.8.2.2) allows an authenticated administrator to corrupt stack memory via the web GUI allow/deny rule parser, ultimately achieving code execution on the repeater host. The flaw (CWE-787, out-of-bounds write) is reachable only after admin login, but that barrier is significantly weakened when chained with CVE-2026-7839 (default password), which can hand an attacker the required credentials. There is no public exploit identified at time of analysis and no EPSS/KEV data supplied, so this is currently a credentialed, chainable RCE rather than a confirmed mass-exploited threat.
RemediationAI
No vendor-released patch version was identified at time of analysis; the referenced advisory link (https://uvnc.com/) is the vendor homepage rather than a fixed-release note, so administrators should check https://uvnc.com/ and https://github.com/ultravnc/UltraVNC for a release above 1.8.2.2 and upgrade as soon as one is confirmed. Until a patched build is available, the highest-value compensating control is to eliminate the credential-chaining path from CVE-2026-7839 by changing the repeater admin password away from any default and enforcing a strong password, since exploitation requires admin authentication (PR:H). Additionally, restrict network access to the repeater web GUI management interface to trusted management hosts only (firewall/ACL to the GUI port), or disable the web GUI entirely if rules are managed by other means, and avoid saving allow/deny rule tokens at or beyond the 25-byte (temp1) / 16-byte (temp2/temp3) buffer limits. The trade-off of locking down the web GUI is reduced remote manageability of allow/deny rules; the trade-off of disabling it is loss of browser-based configuration.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
UltraVNC Repeater is a relay/proxy component of the UltraVNC remote-desktop suite, used to broker VNC connections between viewers and servers across NAT boundaries; its web GUI (webgui/settings.c) manages IP allow/deny rules. The root cause is a classic CWE-787 out-of-bounds write: at settings.c:225-272, after strncpy_s copies a rule token into fixed stack buffers (temp1[rule1] is 25 bytes; temp2/temp3 are 16 bytes), the code unconditionally executes temp1[rule1][len] = 0 to NUL-terminate without clamping len to the buffer size. When the token length equals or exceeds the destination size, the terminator lands one or more bytes past the array end, corrupting adjacent stack data (potentially saved registers, frame pointers, or return addresses) and creating a memory-corruption primitive that can be escalated to control flow hijack.
Know when Ultravnc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable web GUI (AV:N) with a deterministic overflow (AC:L), but admin login is mandatory (PR:H) and no user interaction; code execution yields full C:H/I:H/A:H on the host.
Primary rating from Vendor (securin).
CVSS VectorVendor: securin
DescriptionCVE.org
UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In repeater/webgui/settings.c:225-272, after strncpy_s copies a rule token into temp1[rule1] (25-byte destination) or temp2/temp3 (16-byte destination), the code unconditionally writes a NUL terminator at temp1[rule1][len] = 0 without clamping len to the destination size. When an authenticated administrator saves a rule with a token length equal to or greater than the destination size, the NUL byte is written one or more bytes past the end of the stack-allocated array, corrupting adjacent stack data. An attacker who has obtained admin credentials (including via CVE-2026-7839 default password) can trigger this to gain code execution on the repeater host.
Executive ViewAI
UltraVNC Repeater versions 1.8.2.2 and earlier contain a remote code execution vulnerability (CVE-2026-7829, CVSS 7.2) that allows authenticated administrators to execute arbitrary code on the repeater host through malformed rule parsing. The real-world exploitation risk escalates significantly when chained with CVE-2026-7839 (default password vulnerability), potentially allowing attackers to obtain admin credentials and compromise this network-critical remote access infrastructure component. No vendor patch is currently available, creating an immediate mitigation gap that requires defensive action.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict web GUI network access to specific administrator IP addresses via firewall rules; (2) Enforce strong, unique administrative credentials and rotate on 90-day cycle; (3) Disable Repeater service entirely if not in active use; (4) Implement network segmentation to contain lateral movement if compromise occurs; (5) Deploy IDS/IPS signatures to detect exploitation attempts against the rule parser component.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in UltraVNC Memory Corruption and Cryptographic Flaws
View all 10UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in the Repeater Host configuration field that allow
UltraVNC versions up to 1.6.4.0 suffer from an uncontrolled search path vulnerability in version.dll loaded by the Servi
UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in its password configuration properties that allow
UltraVNC revision 1203 has out-of-bounds access vulnerability in VNC client inside RAW decoder, which can potentially re
UltraVNC revision 1211 has multiple improper null termination vulnerabilities in VNC server code, which result in out-of
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer offer handler, w
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer request handler,
UltraVNC revision 1211 has multiple off-by-one vulnerabilities in VNC server code, which can potentially result in code
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer handler, which c
UltraVNC revision 1206 has multiple off-by-one vulnerabilities in VNC client code connected with improper usage of Clien
UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of ClientConnecti
UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of SETPIXELS macr
Exploit-DB