UltraVNC versions up to 1.8.2.2 generate VNC authentication challenges with a weak pseudo‑random number generator seeded from the current time, the process ID, and an additional rand() call. The combined seed size is only about 31 bits and is derived from publicly visible data. Consequently an attacker who can observe a VNC authentication exchange can enumerate the limited seed space and predict the 16‑byte challenge within seconds. This enables forgery of the authentication response or rapid offline brute‑force attempts, allowing unauthorized remote desktop control.

The vulnerability affects UltraVNC releases through version 1.8.2.2. The affected component is the vncauth.c module that produces the authentication challenge. While the Windows binaries may use CryptGenRandom in a different code path, the reachability of this path in distributed binaries is under investigation, so the primary impact is for the standard Unix/Linux builds of UltraVNC.

The CVSS score of 4.8 indicates moderate severity. Because the attacker requires only a captured authentication conversation and the seed space is small, the practical exploitation risk is higher than the CVSS might suggest, although no EPSS data is available. The vulnerability is not listed in the CISA KEV catalog, so no documented exploit is known yet, but the nature of the weakness means an attacker can generate correct credentials with minimal effort once the challenge is observed.