CVE-2026-7838: UltraVNC Viewer Integer Overflow RCE – Urgent Patching Required

Technical summary

The vulnerability stems from an integer overflow in UltraVNC's RFB protocol parsing. The viewer receives a 4-byte reasonLen field from the server and passes reasonLen+1 to CheckBufferSize(); when reasonLen is 0xFFFFFFFF (max CARD32), the addition overflows to 0, causing the allocator to reserve only 256 bytes. The subsequent ReadString call then attempts to read the original ~4 GiB worth of data into this undersized buffer via repeated ReadExact operations. This occurs in vncviewer/ClientConnection.cpp in two reachable code paths: rfbConnFailed (authentication scheme negotiation) and rfbVncAuthFailed (post-handshake failure), neither requiring prior authentication. The flaw has been confirmed to trigger heap-buffer-overflow writes at offset 256+ in controlled testing.

Business impact

Affected users connecting to remote systems via UltraVNC viewer face immediate remote code execution risk. In typical scenarios—system administrators, support staff, or remote IT personnel—compromise could grant attackers the privileges of the logged-in user. Organizations relying on UltraVNC for remote administration may lose confidentiality, integrity, and availability of both the viewer host and, potentially, downstream systems accessed through that compromised session. The pre-authentication nature of the flaw means no valid credentials are needed; network positioning suffices.

Affected systems

UltraVNC viewer through version 1.8.2.2 is affected. The vulnerability resides in the client-side viewer application; UltraVNC servers are not directly vulnerable through this flaw. Any deployment using the affected viewer—whether on Windows, portable instances, or integrated into third-party remote-support tools—should be considered at risk. Users must verify their installed viewer version and confirm availability of patches from UVNC (verify against the vendor advisory for patch version details).

Exploitability

Exploitability is high. No user interaction beyond initiating a connection is required; the overflow triggers automatically during server response parsing. A malicious VNC server, or any network position permitting RFB stream manipulation (ARP spoofing, DNS hijacking, compromised network infrastructure), can trigger the condition. The attack surface is broad: any viewer user connecting to an untrusted or compromised server is at risk. Proof-of-concept conditions have been demonstrated using controlled test environments, confirming reliable triggering and heap corruption.

Remediation

Immediately update UltraVNC viewer to a patched version released by the UVNC project (consult vendor advisory for exact version number and release date). Until patching is possible, isolate viewer usage to trusted, verified VNC servers over authenticated, encrypted channels. Consider disabling or restricting remote desktop access via UltraVNC until patches are deployed. For organizations, prioritize testing and rollout of patched binaries to all affected users, particularly those with administrative access or access to sensitive systems.

Patch guidance

Monitor the UVNC project's official releases for version 1.8.2.3 or later (verify against vendor advisory). Apply patches systematically across your environment, prioritizing critical infrastructure and administrative workstations. Test in a staging environment before broad rollout to confirm compatibility with your RFB server infrastructure. Portable and installer versions should both be updated. Some organizations may distribute patched binaries internally; verify chain of custody. Older or abandoned instances of UltraVNC (e.g., bundled in legacy tools) should be inventoried and updated or replaced.

Detection guidance

Monitor for unusual network traffic to/from systems running UltraVNC viewer, particularly connections to unexpected VNC servers. Alert on failed RFB connection attempts with abnormally large error message fields. Endpoint Detection and Response (EDR) tools should flag heap corruption events or crash dumps from vncviewer.exe processes. Network-level IDS signatures targeting oversized RFB reasonLen fields may catch some attack attempts. However, post-compromise forensics (memory dumps, process execution logs) are more reliable for confirming exploitation. Assume any system that experienced an unplanned vncviewer crash during this period may have been targeted.

Why prioritize this

This is a high-severity, pre-authentication remote code execution vulnerability affecting a widely-used remote administration tool. The CVSS 8.8 rating reflects the combination of network accessibility, low complexity, lack of privilege requirement, and full confidentiality/integrity/availability impact. Organizations must treat this as urgent: attackers can compromise viewer hosts without valid credentials or user interaction beyond a connection attempt. Rapid patching is critical to prevent mass compromise of administrative users and downstream lateral movement.

Risk score, explained

CVSS 3.1 score of 8.8 (HIGH) is driven by: (1) Network vector—exploitation requires only network connectivity, no physical access; (2) Low attack complexity—triggering the overflow is straightforward via malformed RFB messages; (3) No privileges required—pre-authentication reachability; (4) User interaction required (UI:R)—user must initiate a viewer connection, but no additional interaction is needed once connected; (5) Unchanged scope—impact is confined to the user's system; (6) High CIA impact—successful exploitation enables arbitrary code execution with viewer process privileges. The absence from CISA KEV at publication indicates active exploitation has not yet been formally tracked, but this should not reduce urgency; pre-auth RCE vulnerabilities are historically attractive to attackers.

Frequently asked questions