CVE-2026-7838
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk69th percentile - higher than 69% of all known CVEs
Summary
In UltraVNC viewer up to version 1.8.2.2, an integer overflow leads to a heap buffer overflow in the RFB protocol failure-response parsing path. The 4-byte reasonLen field (CARD32) is passed as reasonLen+1 to CheckBufferSize(), and when set to 0xFFFFFFFF it overflows to 0, causing allocation of only 256 bytes. The subsequent ReadString() then reads the original 4 GiB into that small buffer, causing overflow.
Risk Assessment
A remote unauthenticated attacker (malicious VNC server or man-in-the-middle) can exploit this vulnerability to achieve remote code execution on the victim's machine, gaining full control. The attack requires no authentication and is triggered when the victim connects to a malicious server.
Recommendation
Immediately update UltraVNC viewer to a version newer than 1.8.2.2 once a patch is released. Until then, avoid connecting to untrusted VNC servers and use tunneling (e.g., SSH) to protect against MITM attacks.
Other vulnerabilities in UltraVNC
See all- CVE-2026-7831High
UltraVNC viewer up to version 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message handler. When the server supplies a desktop name of exactly 2024 bytes, the ReadString function writes a null terminator beyond the allocated buffer, potentially corrupting stack data.
- CVE-2026-7830High
UltraVNC up to version 1.8.2.2 uses weak cryptography in the MS-Logon II authentication scheme. The Diffie-Hellman key exchange relies on 64-bit parameters that can be broken in under a second, and the random number generator based on rand() with a time seed allows private key recovery within a minute.
- CVE-2026-7828Medium
UltraVNC repeater up to version 1.8.2.2 contains an integer overflow in the win_log() function during memory allocation for list nodes. An attacker can send a sufficiently long HTTP URI, causing a heap buffer overflow that allows a partial out-of-bounds write.
- CVE-2026-44041Medium
A vulnerability in UltraVNC up to version 1.8.2.2 causes an out-of-bounds read in the wide-string to multibyte conversion helper. The vncWc2Mb() function calls wcslen() on a caller-supplied buffer without prior bounds checking, potentially reading past the allocated memory.
- CVE-2026-44040Medium
UltraVNC through 1.8.2.2 uses a cryptographically weak pseudo-random number generator to produce VNC authentication challenge bytes. The vncRandomBytes() function seeds libc rand() with time(0) + getpid() + rand(), resulting in a seed space of approximately 31 bits, entirely determined by publicly observable values. An attacker can predict the challenge within seconds, enabling forgery or offline brute-forcing of responses.
Original NVD description (English source)
UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap buffer overflow in the RFB protocol failure-response parsing path. In vncviewer/ClientConnection.cpp, the 4-byte network-supplied reasonLen field (type CARD32) is passed as reasonLen+1 to CheckBufferSize(). Because both operands are unsigned 32-bit, a reasonLen of 0xFFFFFFFF overflows to 0, causing CheckBufferSize to allocate only 256 bytes. The subsequent ReadString(m_netbuf, reasonLen) call then performs ReadExact for the original 4 GiB length into that 256-byte heap buffer. This overflow is reachable via rfbConnFailed (auth-scheme negotiation) and rfbVncAuthFailed (post-handshake) message types without successful authentication. A malicious VNC server, or any man-in-the-middle on the RFB stream, can trigger this condition when the victim viewer connects, potentially resulting in remote code execution as the user running the viewer. The crash was confirmed with AddressSanitizer on a portable reproduction harness (heap-buffer-overflow WRITE at offset 256).