Technical impact
A buffer overflow occurs in UltraVNC Viewer 1.2.2.4 when a user supplies an oversized string to the VNC Server input field. The accidental or malicious input of 256 repeated characters causes the application to crash, terminating the viewer and denying service to legitimate users. The vulnerability arises from improper bounds checking of user-supplied data, a classic memory corruption weakness.
Affected Systems
The vulnerability affects the UltraVNC Viewer product from UVNC, specifically version 1.2.2.4. No other versions or products are listed as affected.
Risk and Exploitability
The CVSS score of 7.1 indicates a high severity impact on availability. Although explicit exploit probability is not provided, the logic of the bug suggests that any user running the viewer can trigger the crash by simply entering a long string and clicking Connect. The lack of a CISA KEV listing and no known formal exploit in public exploits implies that the risk of exploitation is moderate, but the potential disruption to user sessions is significant. If unpatched, unattended systems may experience repeated crashes during normal operation or through social‑engineering attempts to insert the malicious string.
