CVE-2026-7828: UltraVNC Repeater Integer Overflow in HTTP Logging—Exploitation & Patching Guide

Technical summary

The vulnerability exists in repeater/webgui/settings.c at line 336 within the win_log() function. The issue stems from unsafe integer arithmetic in the malloc call: malloc(sizeof(struct LIST) + strlen(line)). When strlen(line) approaches the upper bounds of the HTTP receive buffer (153,600 bytes), adding it to sizeof(struct LIST) causes an integer overflow on 32-bit systems, wrapping the result to a much smaller value. The function then copies the full-length line via strcpy into this undersized heap allocation, triggering a classic heap buffer overflow. The overflow is bounded by the WI_RXBUFSIZE constant, which caps the input at approximately 150 KB—well below SIZE_MAX on 32-bit platforms, meaning the overflow is partial rather than wraparound-style unlimited. This constraint limits the immediate exploitability but does not eliminate the memory corruption risk.

Business impact

A denial-of-service condition is the most likely near-term impact: repeated or sustained oversized HTTP requests could crash the repeater service, interrupting remote desktop connectivity for all clients relying on that repeater instance. Depending on heap layout and system configuration, more sophisticated heap exploitation may allow an unauthenticated remote attacker to corrupt adjacent heap structures or, in targeted scenarios, achieve arbitrary code execution within the repeater process—potentially compromising the integrity of all VNC sessions passing through that repeater. Organizations operating UltraVNC repeaters in production should assess the criticality of those services and their exposure to untrusted networks.

Affected systems

UltraVNC repeater through version 1.8.2.2 is affected. The vulnerability applies to any deployment where the repeater's HTTP management interface is accessible to potential attackers. This includes repeaters running on public-facing servers, internal networks with compromised or untrusted clients, and development/testing environments. Repeaters handling mission-critical remote access should be prioritized for patching.

Exploitability

The vulnerability requires network access to the repeater's HTTP port and no authentication credentials. An attacker can craft an HTTP request with a maximally-sized URI to trigger the overflow path. While the bounded nature of the overflow (limited by the 153 KB receive buffer) prevents certain unbounded heap exploitation techniques, practical proof-of-concept work confirms that denial of service is achievable. More sophisticated heap spraying and layout manipulation might extend this to code execution in some configurations, but such attacks depend heavily on the target system's memory layout, heap allocator behavior, and concurrent activity. The CVSS score of 5.3 (MEDIUM) reflects the denial-of-service vector with limited confidentiality or integrity impact in the default scenario.

Remediation

Upgrade UltraVNC repeater to a patched version released after the vulnerability disclosure. Verify the exact patched version number against the official UltraVNC project advisory or release notes. Pending patches, restrict network access to the repeater's HTTP management port via firewall rules—only allow connections from trusted administrative networks. Monitor repeater process stability and consider restarting it periodically if patch deployment is delayed. Test patches in a non-production environment first to ensure compatibility with your VNC client and server configurations.

Patch guidance

Consult the official UltraVNC project website and security advisories for the exact patched version number. The fix likely addresses the integer overflow by either validating the URI length before allocation or using safe arithmetic functions. After patching, verify the repeater version via its admin interface or command-line tools. Rolling out patches should be coordinated with your change management process to minimize downtime; consider scheduling updates during maintenance windows or using multiple repeater instances behind a load balancer to allow phased patching.

Detection guidance

Monitor repeater error logs and system crash reports for signs of buffer overflow exploitation (segmentation faults, access violations, or heap corruption warnings). Network intrusion detection systems should look for HTTP requests to the repeater port with unusually long URIs (approaching or exceeding 150 KB). Implement HTTP request size limits at any proxy or firewall in front of the repeater to reject oversized requests before they reach the vulnerable code. Heap debugging tools (ASAN, Valgrind) can be run in test environments to identify the overflow during security testing of patched versions.

Why prioritize this

This vulnerability merits medium priority for most organizations but high priority for those operating repeaters in untrusted environments or as core infrastructure. The combination of unauthenticated remote access, achievable denial of service, and theoretical code execution paths justifies prompt patching. However, the bounded overflow and lack of confirmed active exploitation in the wild (KEV status: not yet added) reduce the immediate threat compared to critical or high-severity flaws. Prioritize repeaters exposed to the internet or connected to high-value networks; internal repeaters in isolated environments can be addressed in standard patching cycles.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) captures several factors: network-accessible attack vector with low complexity and no privileges required drive severity upward; however, the impact is primarily availability (denial of service) rather than confidentiality or integrity. The bounded nature of the overflow—capped at ~150 KB—prevents the catastrophic heap corruption or arbitrary code execution that would elevate this to HIGH or CRITICAL. The score appropriately reflects a real but limited threat that should not be ignored but can be managed through standard patching procedures and access controls.

Frequently asked questions