By vendor

Uvnc vulnerabilities

Known CVEs affecting Uvnc products, prioritized by severity, with SEC.co remediation and detection guidance.

8 published vulnerabilities

• CVE-2026-7838HIGH 8.8

  UltraVNC viewer versions through 1.8.2.2 contain a critical memory corruption flaw in how they parse error messages from VNC servers. When a malicious or compromised server sends a specially crafted error message during the initial connection phase, the viewer attempts to read far more data than it allocated, overwriting adjacent heap memory. An attacker can exploit this without any valid credentials, potentially executing arbitrary code on the user's machine. The vulnerability occurs before authentication succeeds, making it exploitable by hostile servers or network intermediaries.

• CVE-2026-7831HIGH 7.6

  UltraVNC viewer versions up to 1.8.2.2 contain a stack buffer overflow vulnerability triggered when connecting to a malicious VNC server. The flaw occurs in how the viewer processes the server's desktop name during the initial connection handshake. If a server advertises a desktop name exactly 2024 bytes long, the viewer's buffer handling code writes a null terminator one byte beyond its allocated stack buffer. On systems without stack protection, this single-byte overflow can corrupt adjacent data; on systems with stack canary protection enabled, the corrupted canary causes the viewer to crash. An attacker must trick a user into connecting to their malicious VNC server to trigger the vulnerability.

• CVE-2026-7830HIGH 7.4

  UltraVNC versions through 1.8.2.2 contain a critical weakness in how it secures remote desktop connections using MS-Logon II authentication. The vulnerability allows an attacker who can monitor network traffic—whether through packet sniffing, session recording, or man-in-the-middle positioning—to recover login credentials in plaintext. The flaw stems from two problems: the encryption uses weak 64-bit parameters that can be broken in under a second, and the session key generation relies on predictable random numbers seeded from the system clock, making it recoverable within a minute. Once an attacker obtains the session key, they can decrypt and steal the username and password being transmitted. This is a serious risk for any organization relying on UltraVNC for remote access, especially over untrusted networks.

• CVE-2026-7829HIGH 7.2

  UltraVNC Repeater versions up to 1.8.2.2 contain a stack-based buffer overflow in the settings parser used by the web-based admin interface. When an authenticated administrator configures allow/deny rules with unusually long tokens, the application writes a null terminator past the end of its internal buffer, overwriting adjacent stack memory. An attacker with admin credentials can exploit this to execute arbitrary code on the repeater machine. While direct admin access is normally required, this risk is amplified if an organization has been exposed to the related default-credentials vulnerability (CVE-2026-7839).

• CVE-2026-7828MEDIUM 5.3

  UltraVNC repeater versions up to 1.8.2.2 contain a memory allocation flaw triggered by oversized HTTP requests. When a user sends an HTTP request with an exceptionally long URI to the repeater's web interface port, the logging function attempts to allocate memory based on the URI length but miscalculates the size due to integer overflow. This causes the system to reserve far less memory than needed, and the subsequent copy of the full URI data spills beyond the allocated buffer, corrupting heap memory. An attacker on the network can trigger this condition without authentication, potentially destabilizing the repeater process or, in theory, achieving limited code execution through heap manipulation.

• CVE-2026-44040MEDIUM 4.8

  UltraVNC versions up to 1.8.2.2 use a weak random number generator to create the authentication challenge sent during VNC login. An attacker observing the authentication exchange can predict the challenge by brute-forcing the seed value, which is based only on the system's clock time and process ID—both publicly observable. This enables an attacker to forge authentication or crack the VNC password offline. The vulnerability affects the rfb/vncauth.c code path; Windows binaries may be partially protected by the use of CryptGenRandom on that platform, though the exact code path in shipped binaries is still being verified.

• CVE-2026-44041MEDIUM 4.3

  UltraVNC versions through 1.8.2.2 contain a flaw in how the software processes text encoding conversion. When converting wide-character strings to multibyte format, the code reads from a caller-supplied buffer without first checking its bounds. If that buffer is missing a proper null terminator, the read operation continues beyond the buffer's legitimate memory, exposing data from adjacent memory regions or potentially crashing the application. This vulnerability requires an unusual programming pattern to trigger and is not currently known to be actively exploited.

• CVE-2026-44042LOW 3.7

  UltraVNC Repeater versions up to 1.8.2.2 contain a boundary-checking flaw in the Base64 decoder used to process HTTP Basic authentication credentials. The vulnerability stems from an off-by-one error in the validation logic—the code checks whether decoded output will fit using a strict greater-than (>) comparison instead of greater-than-or-equal (>=). Under current HTTP request constraints, this does not cause exploitable overflow because the Authorization header size is naturally limited; however, the defective check creates a latent condition where a single byte could be written past the intended 1024-byte stack buffer boundary if buffering assumptions change. This is a low-severity finding with limited practical impact in current deployments.