CVE-2026-7829: UltraVNC Repeater Stack Buffer Overflow in Settings Parser

Technical summary

The vulnerability resides in repeater/webgui/settings.c, lines 225–272, where the allow/deny rule parser uses strncpy_s to copy user-supplied tokens into fixed-size stack buffers (25 bytes for temp1, 16 bytes for temp2/temp3). After the copy operation, the code unconditionally writes a null terminator at offset len without verifying that len does not exceed the destination buffer size. This out-of-bounds write corrupts the stack frame, potentially overwriting return addresses, function pointers, or other critical data structures that an attacker can leverage to redirect code execution. The flaw is classified as CWE-787 (Out-of-bounds Write).

Business impact

Successful exploitation allows an administrator-level attacker to achieve remote code execution on UltraVNC Repeater infrastructure. Because repeaters are typically used to relay VNC connections across network boundaries, a compromised repeater becomes a pivotal point of control, potentially granting an attacker access to all downstream VNC sessions and internal networks relying on that repeater for connectivity. The impact extends beyond the repeater host to the entire ecosystem of clients and servers it mediates.

Affected systems

UltraVNC Repeater through version 1.8.2.2 is affected. Organizations running repeater instances for VNC session relay should verify their installed versions immediately. All instances that allow administrator access—whether local or remote—are at risk if credentials have been compromised or are weak.

Exploitability

Exploitation requires valid administrator credentials for the UltraVNC Repeater web interface. The attack is straightforward once credentials are obtained: an authenticated attacker simply saves a rule with a crafted token length to trigger the buffer overflow. The CVSS vector (AV:N/AC:L/PR:H) confirms network-level accessibility with high privileges required but low attack complexity. Notably, the prerequisite admin access may be easier to obtain than expected if the default-credentials vulnerability (CVE-2026-7839) has not been remediated in parallel.

Remediation

Update UltraVNC Repeater to a patched version that properly bounds-checks the token length before writing the null terminator. Verify the exact patched version against the official UVNC project or vendor advisory. As an interim control, restrict network access to the UltraVNC Repeater web admin interface using firewall rules or VPN, permitting only known administrative hosts. Audit admin account privileges and credentials, and rotate any credentials known or suspected to have been exposed.

Patch guidance

Consult the official UltraVNC project repository or vendor advisory for patched versions beyond 1.8.2.2. Apply patches in a staged manner to non-production repeaters first to validate compatibility with your VNC client and server deployments. Document the versions and patch dates for audit compliance.

Detection guidance

Monitor UltraVNC Repeater log files for administrative configuration changes, particularly modifications to allow/deny rules with unusually long tokens or suspicious patterns. Implement file integrity monitoring (FIM) on the repeater's settings or configuration files to detect unauthorized changes. Network-based detection is challenging because the exploitation happens entirely within the admin interface, but anomalous process behavior (e.g., child processes spawned from the repeater service) post-exploitation may be detected via EDR or process monitoring. Review authentication logs for successful logins using non-standard or default credentials.

Why prioritize this

Although exploitation requires high-privilege access (admin credentials), the impact is critical—code execution on a network pivot point affects all VNC sessions it relays. The presence of a related default-credentials vulnerability (CVE-2026-7839) that can grant admin access without prior compromise makes this a linked threat requiring immediate attention. Organizations relying on UltraVNC Repeater for critical VNC infrastructure should prioritize patches within their normal maintenance windows.

Risk score, explained

The CVSS 3.1 score of 7.2 (HIGH) reflects high impact (confidentiality, integrity, and availability all set to H) balanced against the requirement for high-privilege access (PR:H) and low attack complexity (AC:L). The score does not account for the attenuating factor that default credentials (CVE-2026-7839) might lower the barrier to obtaining admin privileges in affected environments, potentially warranting elevated internal risk scores for those organizations.

Frequently asked questions