CVE-2026-7838
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk63th percentile — higher than 63% of all known CVEs
Summary
UltraVNC viewer up to version 1.8.2.2 contains an integer overflow leading to a heap buffer overflow in the RFB protocol failure-response parsing path. The 4-byte reasonLen field (CARD32) is passed as reasonLen+1 to CheckBufferSize(), where a value of 0xFFFFFFFF overflows to 0, allocating only 256 bytes, followed by reading 4 GiB into that buffer. This is reachable without authentication via rfbConnFailed and rfbVncAuthFailed message types.
Risk Assessment
A malicious VNC server or man-in-the-middle on the RFB stream can trigger this condition when the victim connects, potentially resulting in remote code execution as the user running the viewer.
Recommendation
Update UltraVNC viewer to a version newer than 1.8.2.2 as soon as a patch is released. Until then, avoid connecting to untrusted VNC servers and use tunneling encryption (e.g., SSH) to protect against MITM attacks.
Original NVD description (English source)
UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap buffer overflow in the RFB protocol failure-response parsing path. In vncviewer/ClientConnection.cpp, the 4-byte network-supplied reasonLen field (type CARD32) is passed as reasonLen+1 to CheckBufferSize(). Because both operands are unsigned 32-bit, a reasonLen of 0xFFFFFFFF overflows to 0, causing CheckBufferSize to allocate only 256 bytes. The subsequent ReadString(m_netbuf, reasonLen) call then performs ReadExact for the original 4 GiB length into that 256-byte heap buffer. This overflow is reachable via rfbConnFailed (auth-scheme negotiation) and rfbVncAuthFailed (post-handshake) message types without successful authentication. A malicious VNC server, or any man-in-the-middle on the RFB stream, can trigger this condition when the victim viewer connects, potentially resulting in remote code execution as the user running the viewer. The crash was confirmed with AddressSanitizer on a portable reproduction harness (heap-buffer-overflow WRITE at offset 256).