UltraVNC Launcher 1.2.2.4 contains a buffer overflow in the Path vncviewer.exe property field that lets a local attacker crash the application by entering an overly long string, resulting in a denial of service for legitimate users.

The vulnerable product is UltraVNC Launcher version 1.2.2.4 from the Uvnc vendor.

The CVSS score of 6.9 indicates moderate severity, and the EPSS value is unavailable; the vulnerability is not listed in the KEV catalog. The exploit requires local user access and a crafted input via the Properties dialog, so its potential impact is limited to systems where an attacker can run the application locally and supply the attack payload.