CVE-2026-44042: UltraVNC Repeater Off-by-One Buffer Boundary Flaw

Technical summary

The vulnerability exists in repeater/webgui/webutils.c at line 817 within the wi_uudecode() function. When validating Base64-decoded HTTP Basic authentication data, the function compares input length against the output buffer size using a greater-than operator. The Base64 decoding process produces output approximately 3/4 the size of the input, so the check is mathematically loose by one condition: when strlen(authdata) exactly equals sizeof(decode), the decoded result fits nominally, but the comparison logic does not account for the equals case. The practical constraint is that HTTP Authorization headers are bounded by standard HTTP request limits, preventing the buffer from receiving enough input to trigger overflow. The CWE-193 classification (off-by-one error) is appropriate. If future code changes relax the HTTP-level constraints or if the buffer is reused in different contexts, this condition could become exploitable.

Business impact

The immediate business risk is minimal. The vulnerability cannot be reliably triggered under normal HTTP request processing, and no privilege escalation or data confidentiality compromise is possible. A potential denial-of-service via repeater crash is theoretically possible if an attacker crafted an Authorization header at the exact boundary condition, but this is difficult and unreliable. Organizations running UltraVNC Repeater should treat this as a code-quality issue requiring eventual remediation rather than an urgent incident response. The main concern is architectural: any system relying on Repeater for critical remote desktop connectivity should plan to update once patched versions are available.

Affected systems

UltraVNC Repeater through version 1.8.2.2 is affected. The repeater component is typically deployed as a network relay for VNC connections, often in corporate remote support and desktop-as-a-service environments. Systems where the Repeater is exposed to untrusted networks carry slightly higher risk. The vulnerability affects the HTTP-based web GUI authentication path, so Repeater deployments using only VNC protocol (without HTTP GUI access) face minimal exposure.

Exploitability

Exploitability is low and impractical under current constraints. An attacker would need network access to the Repeater's HTTP service and would need to craft a malformed Authorization header at a precise boundary—a one-byte overflow of a stack buffer during Base64 decoding. The HTTP protocol itself enforces request size limits that prevent the necessary input length from reaching the decoder. CVSS 3.1 score of 3.7 (LOW severity) reflects this: only availability impact is possible, attack complexity is high, and no user interaction is required. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no public exploit code is known.

Remediation

Update UltraVNC Repeater to a version that corrects the boundary check in wi_uudecode(). Verify with the vendor that the patched release addresses the greater-than-or-equal comparison fix. Until patched, mitigate by restricting network access to the Repeater's HTTP management interface using firewall rules or network segmentation—limit access to trusted administrative networks only. Do not expose the Repeater's web GUI to the public internet.

Patch guidance

Monitor the UVNC project repository and official releases for a version newer than 1.8.2.2 that documents the fix. When a patched version becomes available, test it in a non-production environment before deployment. Standard change-control procedures apply. Because the vulnerability requires both network access and precise boundary conditions to be remotely exploitable, patching can be scheduled in normal maintenance windows rather than treated as emergency. Verify the patch release notes explicitly mention correction of the off-by-one condition in Base64 decoding.

Detection guidance

Monitor HTTP request logs to the Repeater service for Authorization headers with unusual length or encoding patterns near the buffer boundary size. Intrusion detection systems may flag attempts to send Authorization headers deliberately crafted at maximum length with malformed Base64. Runtime stack canaries and address-space layout randomization (ASLR) on the Repeater host provide defense-in-depth against stack corruption. Endpoint detection and response (EDR) tools should flag any unexpected crashes or memory violations in the repeater process. Network-based detection is difficult because the attack surface is constrained by HTTP request processing.

Why prioritize this

This vulnerability merits a LOW priority in patching schedules due to its constrained exploitability, low CVSS score, and absence from active exploitation lists. However, it should not be ignored indefinitely: the latent nature of the flaw means future code changes could increase risk, and organizations should apply patches during normal maintenance cycles. Prioritize systems where the Repeater is accessible from less-trusted networks or where it is part of critical remote-access infrastructure.

Risk score, explained

CVSS 3.1 score 3.7 (LOW) reflects: Network-based attack vector (AV:N), High attack complexity due to HTTP request constraints (AC:H), no privileges required (PR:N), no user interaction needed (UI:N), unchanged scope (S:U), zero confidentiality or integrity impact (C:N/I:N), and low availability impact (A:L). The score appropriately captures that while a theoretical flaw exists, practical exploitation is severely limited by buffering constraints outside the vulnerable function.

Frequently asked questions