CVE-2026-7829
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
In UltraVNC repeater up to version 1.8.2.2, a post-authentication out-of-bounds write vulnerability exists. In the allow/deny rule parser, after copying a token into a fixed-size buffer, the code unconditionally writes a NUL terminator at position len without checking if it exceeds the buffer size. An authenticated administrator can save a rule with a token length equal to or greater than the buffer size, overwriting adjacent stack data.
Risk Assessment
An attacker who has obtained admin credentials (e.g., via CVE-2026-7839 default password) can exploit this vulnerability to achieve code execution on the repeater host. This leads to full server compromise and potential lateral movement within the network.
Recommendation
Immediately update UltraVNC repeater to a version later than 1.8.2.2 where this vulnerability is fixed. Until the update, change the default admin password and restrict access to the management panel to trusted IP addresses only.
Other vulnerabilities in UltraVNC repeater
See all- CVE-2016-5673High
UltraVNC Repeater before 1300 does not restrict destination IP addresses or TCP ports, allowing remote attackers to obtain open-proxy functionality by using a :: substring between the IP address and port number.
- CVE-2026-7840Critical
UltraVNC repeater through version 1.8.2.2 contains a global buffer overflow in its embedded HTTP administration server. The functions wi_senderr() and wi_replyhdr() in repeater/webgui/webutils.c write the caller-supplied HTTP request URI into a fixed 1000-byte global buffer (hdrbuf) via unchecked sprintf calls. The HTTP receive buffer accepts URIs up to approximately 150 KB (WI_RXBUFSIZE = 153600), so an unauthenticated attacker who can reach the repeater HTTP port (default TCP 80) can overflow hdrbuf by at least 500 bytes with a single HTTP request containing a URI of 1500 bytes or longer, corrupting adjacent .bss-segment globals.
- CVE-2026-7839Critical
UltraVNC repeater up to version 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. On first run, when settings2.txt is absent, it writes the literal string "adminadmi2" as the admin password. The HTTP Basic-auth handler checks this password without rate-limiting or lockout.
- CVE-2026-44042Low
UltraVNC repeater up to version 1.8.2.2 contains an off-by-one error in the Base64 decode helper used for HTTP Basic authentication. The wi_uudecode() function in webutils.c:817 uses a strict greater-than comparison (>) instead of greater-than-or-equal (>=), leaving a latent vulnerability. Currently, the risk is limited to a one-byte write at the boundary of a 1024-byte stack buffer.
Original NVD description (English source)
UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In repeater/webgui/settings.c:225-272, after strncpy_s copies a rule token into temp1[rule1] (25-byte destination) or temp2/temp3 (16-byte destination), the code unconditionally writes a NUL terminator at temp1[rule1][len] = 0 without clamping len to the destination size. When an authenticated administrator saves a rule with a token length equal to or greater than the destination size, the NUL byte is written one or more bytes past the end of the stack-allocated array, corrupting adjacent stack data. An attacker who has obtained admin credentials (including via CVE-2026-7839 default password) can trigger this to gain code execution on the repeater host.