UltraVNC Repeater EUVD-2026-40886

Exploitation requires network reachability to the UltraVNC repeater's embedded HTTP administration server, which listens on default TCP port 80, and that HTTP admin service must be enabled and reachable. No authentication is required (PR:N) because the overflow in wi_senderr()/wi_replyhdr() executes before the credential check, and no user interaction is needed (UI:N). The concrete trigger is a single HTTP request whose URI is 1500 bytes or longer - exceeding the 1000-byte hdrbuf while still fitting inside the ~150 KB WI_RXBUFSIZE receive buffer. Limiting factors that reduce real-world risk: the repeater's HTTP admin port must actually be exposed to the attacker (deployments that firewall it or bind it to localhost are not reachable), and reliable code execution from a global/.bss overflow depends on adjacent memory layout, so the flaw is trigger-trivial but weaponization is non-trivial.

All available signals point to genuine high risk: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) indicates a network-reachable, low-complexity, unauthenticated attack with high impact to confidentiality, integrity, and availability, scoring 9.3, and the overflow occurs before the authentication check so no credentials are needed. Countervailing factors: no EPSS score was supplied in the input, there is no CISA KEV listing, and no public proof-of-concept was referenced, so there is no evidence of active exploitation or weaponization at this time; additionally, reliable exploitation to full RCE from a .bss/global overflow is typically harder than a stack-based overflow because it depends on memory layout and how adjacent globals are used. Net assessment: treat as a high-priority patch/mitigation target because it is pre-auth and network-facing, but the absence of KEV, POC, and EPSS data means real-world exploitation is currently unproven rather than confirmed. Practical exposure is gated primarily by whether the repeater's HTTP admin port is reachable from untrusted networks.

An attacker who can reach the repeater's HTTP admin port (TCP 80) - for example an internet-exposed or flat-network repeater - sends a single crafted HTTP request whose URI is 1500+ bytes. The oversized URI is copied via unchecked sprintf into the 1000-byte hdrbuf before any authentication runs, overflowing it by 500+ bytes and corrupting adjacent .bss globals to steer the process toward attacker-controlled code execution. No public POC is currently referenced and reliability depends on memory layout, but the trigger itself is a trivial oversized request.