EUVD-2026-40884
GHSA-wxqv-4fpj-f62j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable pre-auth flaw (AV:N/PR:N) but victim must initiate the viewer connection (UI:R); heap corruption enabling code execution as the user gives C/I/A:H, scope unchanged.
Primary rating from Vendor (securin).
CVSS VectorVendor: securin
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap buffer overflow in the RFB protocol failure-response parsing path. In vncviewer/ClientConnection.cpp, the 4-byte network-supplied reasonLen field (type CARD32) is passed as reasonLen+1 to CheckBufferSize(). Because both operands are unsigned 32-bit, a reasonLen of 0xFFFFFFFF overflows to 0, causing CheckBufferSize to allocate only 256 bytes. The subsequent ReadString(m_netbuf, reasonLen) call then performs ReadExact for the original 4 GiB length into that 256-byte heap buffer. This overflow is reachable via rfbConnFailed (auth-scheme negotiation) and rfbVncAuthFailed (post-handshake) message types without successful authentication. A malicious VNC server, or any man-in-the-middle on the RFB stream, can trigger this condition when the victim viewer connects, potentially resulting in remote code execution as the user running the viewer. The crash was confirmed with AddressSanitizer on a portable reproduction harness (heap-buffer-overflow WRITE at offset 256).
AnalysisAI
Remote code execution in the UltraVNC Viewer (all versions through 1.8.2.2) stems from an integer overflow in the RFB failure-response parser: a malicious or man-in-the-middle VNC server can send a reasonLen of 0xFFFFFFFF that wraps to 0 during buffer sizing, then stream 4 GiB into a 256-byte heap allocation. The flaw is reachable pre-authentication through connection-failure and auth-failure messages, so merely connecting a viewer to an attacker-controlled endpoint can corrupt the heap and potentially execute code as the user running the viewer. No public exploit identified at time of analysis, though the researcher confirmed a reliable heap-buffer-overflow write with AddressSanitizer.
Technical ContextAI
UltraVNC is a Windows remote-desktop client/server implementing the RFB (Remote Framebuffer) protocol used by the VNC family. The bug lives in vncviewer/ClientConnection.cpp, where a server-supplied 4-byte CARD32 reasonLen field is passed as reasonLen+1 into CheckBufferSize(). Both operands are unsigned 32-bit, so reasonLen=0xFFFFFFFF makes reasonLen+1 wrap to 0 (the CWE-190 integer-overflow root cause), and CheckBufferSize allocates only its 256-byte minimum. The follow-on ReadString(m_netbuf, reasonLen) then performs a ReadExact for the original ~4 GiB length into that undersized heap buffer, producing an out-of-bounds heap WRITE at offset 256. The vulnerable code paths are rfbConnFailed (auth-scheme negotiation) and rfbVncAuthFailed (post-handshake), both of which execute before any successful authentication. CPE cpe:2.3:a:uvnc:ultravnc identifies the affected product.
RemediationAI
No vendor-released patch or fixed version number was identified in the provided data, so the exact upgrade target cannot be cited yet - monitor the vendor advisory at https://uvnc.com/ and the source repository at https://github.com/ultravnc/UltraVNC for a release above 1.8.2.2 and upgrade viewers immediately once published. Because this is a client-side flaw triggered by the viewer connecting outward, the most effective compensating control is to restrict which endpoints operators may connect to: only connect UltraVNC viewers to known, trusted servers and avoid connecting to untrusted or attacker-supplied addresses (trade-off: operational friction for ad-hoc support sessions). To defeat the man-in-the-middle vector, tunnel RFB traffic over an authenticated encrypted channel such as a VPN or SSH tunnel and disable plaintext RFB over untrusted networks (trade-off: added setup and no protection if the endpoint server itself is malicious). Where feasible, run the viewer as a low-privileged user and segment/limit outbound connectivity from support workstations to reduce blast radius until a patched build is available.
UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in the Repeater Host configuration field that allow
UltraVNC versions up to 1.6.4.0 suffer from an uncontrolled search path vulnerability in version.dll loaded by the Servi
UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in its password configuration properties that allow
UltraVNC revision 1203 has out-of-bounds access vulnerability in VNC client inside RAW decoder, which can potentially re
UltraVNC revision 1211 has multiple improper null termination vulnerabilities in VNC server code, which result in out-of
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer offer handler, w
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer request handler,
UltraVNC revision 1211 has multiple off-by-one vulnerabilities in VNC server code, which can potentially result in code
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer handler, which c
UltraVNC revision 1206 has multiple off-by-one vulnerabilities in VNC client code connected with improper usage of Clien
UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of ClientConnecti
UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of SETPIXELS macr
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today