CVE-2026-7829: fallo de gravedad alta en uvnc UltraVNC
UltraVNC repeater authenticated out-of-bounds write in rule parser via oversized token
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.2epss 0.9%
UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In repeater/webgui/settings.c:225-272, after strncpy_s copies a rule token into temp1[rule1] (25-byte destination) or temp2/temp3 (16-byte destination), the code unconditionally writes a NUL terminator at temp1[rule1][len] = 0 without clamping len to the destination size. When an authenticated administrator saves a rule with a token length equal to or greater than the destination size, the NUL byte is written one or more bytes past the end of the stack-allocated array, corrupting adjacent stack data. An attacker who has obtained admin credentials (including via CVE-2026-7839 default password) can trigger this to gain code execution on the repeater host.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Productos afectados
uvnc · UltraVNCCVEs relacionadas — uvnc UltraVNC
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-7840CRITICALUltraVNC repeater HTTP server global buffer overflow via long URI (pre-auth RCE)EPSS 2.6%CVE-2026-7838HIGHUltraVNC viewer heap buffer overflow via integer overflow in RFB connection-failure reason lengthEPSS 1.9%CVE-2026-7828MEDIUMUltraVNC repeater integer overflow in win_log malloc leading to heap overflowEPSS 1.4%CVE-2026-7831HIGHUltraVNC viewer off-by-one stack overflow in ServerInit desktop name parsingEPSS 0.7%CVE-2026-7839CRITICALUltraVNC repeater ships hardcoded default admin password allowing unauthenticated admin accessEPSS 0.7%CVE-2026-44042LOWUltraVNC repeater wi_uudecode off-by-one in base64 decode boundary checkEPSS 0.5%