CVE-2026-44041: UltraVNC Out-of-Bounds Read in Wide-String Conversion

Technical summary

CVE-2026-44041 is an out-of-bounds read vulnerability in the vncWc2Mb() helper function located in rfb/dh.cpp:204 of UltraVNC through version 1.8.2.2. The function invokes wcslen() on a WCHAR pointer supplied by the caller prior to performing boundary validation. If the wide-character buffer lacks proper NUL termination, wcslen() will read beyond the allocated buffer boundary until locating a NUL wchar, triggering an out-of-bounds read. While Win32 API conventions normally prevent this scenario, anomalous caller contracts can instantiate the condition. The read operation may disclose adjacent memory contents or induce a process crash if the over-read traverses a page boundary, causing an access violation.

Business impact

The primary risk stems from potential denial of service through process crash, which could interrupt remote desktop services for affected users. Secondary risk involves information disclosure if an attacker can craft conditions to leak memory contents—though this requires abnormal caller patterns. Organizations relying on UltraVNC for remote administration should assess exposure; the low severity score reflects the unusual preconditions needed to trigger the flaw and the lack of active exploitation.

Affected systems

UltraVNC versions 1.8.2.2 and earlier are affected. The vulnerability exists in the wide-string conversion helper, a component used during RFB protocol message handling. Any deployment of UltraVNC as a remote access tool—whether server-side or integrated into products that bundle UltraVNC—should be considered within scope for assessment.

Exploitability

Exploitation is not straightforward. The vulnerability requires an abnormal caller contract—specifically, a code path that passes a non-null-terminated wide-character buffer to vncWc2Mb(). Standard Win32 API usage patterns would not ordinarily produce such a scenario. No public exploit code or proof-of-concept has been disclosed, and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. The out-of-bounds read nature makes reliable exploitation difficult; consistent information disclosure or controlled denial of service would require precise memory layout knowledge.

Remediation

Update UltraVNC to a version newer than 1.8.2.2 once available from the vendor. Verify against the official UltraVNC project repository or advisory for the specific patched version. Until patching is feasible, audit code paths that invoke vncWc2Mb() to confirm that all callers provide properly null-terminated wide-character buffers, and review access controls to restrict RFB connections to trusted networks.

Patch guidance

Monitor the UltraVNC project repository and official security advisories for a patched version addressing this out-of-bounds read. Patches may be released under a version number greater than 1.8.2.2; verify the fix against the vendor's changelog to confirm that the vncWc2Mb() function now validates buffer bounds before calling wcslen(). Apply patches during a maintenance window that minimizes disruption to remote access services. Test patched versions in a non-production environment before wider deployment.

Detection guidance

Review application event logs for abnormal terminations or crashes of UltraVNC processes, particularly those coinciding with unusual RFB protocol messages. Monitor memory access violations and page faults involving UltraVNC. Conduct static code analysis of integration points where vncWc2Mb() is called to identify whether callers guarantee null-terminated buffers. Network-based detection is difficult given the requirement for abnormal caller conditions; focus on host-based telemetry and code review.

Why prioritize this

This vulnerability ranks as medium severity (CVSS 3.1) and should be addressed during normal patch cycles rather than through emergency response. The combination of abnormal preconditions, lack of active exploitation, and limitation to denial of service or memory disclosure (without code execution) justifies a standard remediation timeline. Organizations with UltraVNC exposed to untrusted networks should prioritize higher than those with segmented or access-controlled deployments.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) reflects: network-accessible attack vector, low attack complexity, requirement for prior authentication (PR:L), absence of impact to confidentiality or integrity (C:N/I:N), and limited availability impact (A:L). The score appropriately penalizes the vulnerability for its exploitability barriers—specifically the abnormal caller contract needed to trigger the flaw—while acknowledging the potential for denial of service.

Frequently asked questions