CVE-2026-7831: UltraVNC Viewer Stack Buffer Overflow (Off-by-One) – HIGH Severity

Technical summary

The vulnerability exists in vncviewer/ClientConnection.cpp's ServerInit message handler. When processing the RFB protocol's ServerInit message, the code allocates a fixed 2024-byte stack buffer (_dn[2024]) for the desktop name. The ReadString function writes input data followed by a NUL terminator at position buf[length]. When nameLength equals exactly 2024, ReadString writes the terminator at _dn[2024], which is one byte past the buffer boundary. This off-by-one error (CWE-193) results in a stack buffer overflow (CWE-787). The single-byte NUL write overwrites whatever stack data immediately follows the buffer. Builds compiled with /GS stack canary protection will detect the canary corruption and terminate the process; unprotected builds may allow memory corruption without immediate detection.

Business impact

This vulnerability affects any organization using UltraVNC viewer for remote system administration or technical support. An attacker controlling a network service (or positioned to intercept VNC connections) can crash the viewer application, disrupting remote access workflows and potentially locking administrators out of critical systems. The denial-of-service impact is certain on canary-protected builds. On unprotected builds, while a single-byte overflow is limited, it could enable stack data corruption or in carefully crafted scenarios potentially lead to more serious consequences. The requirement for user interaction—connecting to a malicious server—limits the attack surface but remains credible in social engineering or man-in-the-middle scenarios.

Affected systems

UltraVNC viewer through version 1.8.2.2 is affected. Organizations running this version or earlier on Windows systems (where /GS stack protection may or may not be enabled depending on build configuration) should assume they are vulnerable. Remote desktop access workflows using UltraVNC are the primary exposure vector. Users of newer versions should verify they are running a patched release per the vendor advisory.

Exploitability

Exploitation requires user interaction—the victim must initiate a connection to the attacker's malicious VNC server. Network access is required, but no authentication is needed at the VNC protocol level; the overflow occurs during the initial ServerInit handshake before authentication. The attack is deterministic: a nameLength of exactly 2024 bytes reliably triggers the condition. An attacker can easily craft a malicious RFB ServerInit message with the required desktop name length. On canary-protected builds, reliable denial of service is achievable; on unprotected builds, the single-byte overwrite outcome depends on adjacent stack layout but poses meaningful risk.

Remediation

Upgrade UltraVNC viewer to a patched version released after this vulnerability's public disclosure. Consult the UltraVNC project's advisory for the specific patched release. Until patching is possible, restrict users from connecting to untrusted or unverified VNC servers, and use network controls (firewall, VPN, host-based filtering) to ensure VNC connections only reach known, trusted infrastructure. Monitor for unexpected viewer crashes, which may indicate exploitation attempts.

Patch guidance

Check the UltraVNC project's official release notes and advisories for the first patched version following 1.8.2.2. Apply patches to all systems running the vulnerable viewer version. Verify in your environment that the viewer version has been updated by checking the application's About dialog or version properties. Test remote access workflows after patching to ensure continuity. If you are responsible for distributing UltraVNC within your organization, update your deployment baseline and prioritize rollout to users in sensitive or high-availability roles.

Detection guidance

Monitor for UltraVNC viewer process crashes on your endpoints, particularly crashes occurring immediately after VNC connection initiation. Check application event logs for unexpected termination of vncviewer.exe. Network-based detection is limited but possible: observe for VNC ServerInit messages with unusual desktop name lengths (near 2024 bytes). Endpoint detection and response (EDR) tools can alert on abnormal process termination patterns correlated with remote desktop activity. Conduct an inventory of UltraVNC viewer installations to identify systems still running versions through 1.8.2.2.

Why prioritize this

This vulnerability rates HIGH priority (CVSS 7.6) because it is easily exploitable with user interaction, affects confidentiality and integrity on unprotected builds, and guarantees denial of service on canary-protected systems. The requirement for user interaction (connection to a malicious server) moderates the risk but does not eliminate it, especially in environments where users may be socially engineered or where network segmentation is weak. Remote access tooling is critical infrastructure; disruption has immediate operational impact. Patch this vulnerability promptly in your deployment schedule.

Risk score, explained

The CVSS 7.6 HIGH score reflects network accessibility (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), user interaction required (UI:R), impacts to confidentiality (C:L) and integrity (I:L), and high availability impact (A:H). The availability impact is high because denial of service (process crash) is reliable and certain on protected builds and potential on unprotected builds. The presence of CWE-193 (off-by-one) and CWE-787 (out-of-bounds write) justifies the integrity and confidentiality concerns, though the single-byte overwrite limits their immediate exploitability in most configurations.

Frequently asked questions