EUVD-2026-40883
GHSA-38w7-mq68-3h8q
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Attacker-controlled server needs no privileges (PR:N) but victim must connect (UI:R); single-NUL primitive yields reliable DoS (A:H) and minor integrity impact, no realistic confidentiality leak (C:N).
Primary rating from Vendor (securin).
CVSS VectorVendor: securin
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Lifecycle Timeline
3DescriptionCVE.org
UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message handler. In vncviewer/ClientConnection.cpp, when the server-supplied nameLength equals exactly 2024 the code declares a 2024-byte stack buffer _dn[2024] and calls ReadString(_dn, 2024). ReadString writes the NUL terminator at buf[length], i.e., _dn[2024], one byte past the end of the stack buffer. A malicious VNC server can trigger this condition by advertising a desktop name of length 2024 in its ServerInit message. On release builds without stack canaries the single-byte NUL overwrite adjacent stack data. On builds with /GS stack protection the canary is corrupted and the process terminates, resulting in denial of service. User interaction (connecting the viewer to the malicious server) is required.
AnalysisAI
Denial of service in the UltraVNC viewer (vncviewer) through 1.8.2.2 arises from an off-by-one stack buffer overflow in the RFB ServerInit message handler, where a malicious VNC server advertising a desktop name of exactly 2024 bytes forces ReadString to write a NUL terminator at _dn[2024], one byte past a 2024-byte stack buffer. A rogue or compromised server can crash victims who connect to it (reliable process termination on /GS-hardened builds) and potentially corrupt adjacent stack data on canary-less release builds. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; exploitation requires the victim to initiate a connection to the attacker-controlled server.
Technical ContextAI
UltraVNC is a Windows remote-access suite implementing the RFB (Remote Framebuffer) protocol used by VNC. During session setup, the server sends a ServerInit message containing a name-length field followed by the desktop name string. In vncviewer/ClientConnection.cpp the client trusts the server-supplied nameLength: when it equals 2024 it stack-allocates _dn[2024] and calls ReadString(_dn, 2024), but ReadString appends a NUL terminator at buf[length] - index 2024 - writing one byte beyond the buffer. This is a classic CWE-193 (Off-by-One Error) boundary miscalculation, where the terminator is not accounted for in the buffer sizing. The affected CPE is cpe:2.3:a:uvnc:ultravnc:*:*:*:*:*:*:*:*, covering the UltraVNC application family up to and including 1.8.2.2.
RemediationAI
No vendor-released patch version is identified in the provided data - monitor the vendor site https://uvnc.com/ and the source repository https://github.com/ultravnc/UltraVNC for a release above 1.8.2.2 that corrects the ServerInit name-length handling, and upgrade to that build once published (do not rely on an assumed version number). As a compensating control, only connect the UltraVNC viewer to trusted, known-good servers and avoid clicking VNC links or connection files from untrusted sources, since exploitation requires the victim to initiate the connection; this restricts convenience but eliminates the attack surface. Where feasible, run the viewer on /GS-protected builds so the overflow deterministically terminates the process (a controlled crash) rather than silently corrupting adjacent stack data on canary-less release builds, and restrict outbound VNC (typically TCP 5900/5800) to approved server endpoints via host or network firewall to prevent connections to rogue servers.
UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in the Repeater Host configuration field that allow
UltraVNC versions up to 1.6.4.0 suffer from an uncontrolled search path vulnerability in version.dll loaded by the Servi
UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in its password configuration properties that allow
UltraVNC revision 1203 has out-of-bounds access vulnerability in VNC client inside RAW decoder, which can potentially re
UltraVNC revision 1211 has multiple improper null termination vulnerabilities in VNC server code, which result in out-of
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer offer handler, w
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer request handler,
UltraVNC revision 1211 has multiple off-by-one vulnerabilities in VNC server code, which can potentially result in code
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer handler, which c
UltraVNC revision 1206 has multiple off-by-one vulnerabilities in VNC client code connected with improper usage of Clien
UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of ClientConnecti
UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of SETPIXELS macr
Same weakness CWE-193 – Off-by-one Error
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today