Description
UltraVNC through 1.8.2.2 contains an out-of-bounds read in the wide-string to multibyte conversion helper. In rfb/dh.cpp:204, the vncWc2Mb() function passes a caller-supplied WCHAR pointer to wcslen() before any bounds check. If the caller provides a wide-character buffer that is not properly NUL-terminated, wcslen() reads past the end of the buffer until it encounters a NUL wchar, resulting in an out-of-bounds read. Under typical Win32 API usage this requires an abnormal caller contract. Impact is limited to a potential information disclosure from adjacent memory regions or a process crash (denial of service) if the over-read crosses a page boundary.
Published: 2026-07-01
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

UltraVNC versions up to and including 1.8.2.2 contain an out‑of‑bounds read in the helper function vncWc2Mb. The routine passes a caller supplied wide‑character pointer to wcslen() before performing any bounds check. If the buffer is not properly NUL‑terminated, wcslen() reads beyond the buffer until it encounters a NUL wchar, which can leak adjacent memory contents or cause a process crash if the over‑read crosses a memory page boundary.

Affected Systems

The vulnerability affects UltraVNC products supplied by uvnc:UltraVNC, including all releases through 1.8.2.2.

Risk and Exploitability

The CVSS score is 4.3, indicating moderate risk, and the EPSS score is not available. This weakness is not listed in CISA’s KEV catalog. Exploitation would typically require an abnormal caller contract in Win32 API usage, making the likelihood of real‑world attacks relatively low; the impact is limited to potential data leakage or a service denial from a buffer over‑read.

Generated by OpenCVE AI on July 1, 2026 at 13:09 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the latest UltraVNC release that removes the vulnerable wcslen() call or applies the vendor’s patch if one is available.
  • If an update is not immediately possible, ensure that all wide‑string input buffers handed to vncWc2Mb() are NUL‑terminated, or replace the helper with a bounds‑checked routine that validates string length before conversion.
  • Configure crash‑dumping or monitoring so that any segmentation faults or unbounded memory reads are detected promptly, and consider isolating the component or applying process‑level memory protection until a patch is applied.

Generated by OpenCVE AI on July 1, 2026 at 13:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 09 Jul 2026 05:30:00 +0000

Type Values Removed Values Added
References

Wed, 01 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Uvnc
Uvnc ultravnc
Vendors & Products Uvnc
Uvnc ultravnc

Wed, 01 Jul 2026 05:00:00 +0000

Type Values Removed Values Added
Description UltraVNC through 1.8.2.2 contains an out-of-bounds read in the wide-string to multibyte conversion helper. In rfb/dh.cpp:204, the vncWc2Mb() function passes a caller-supplied WCHAR pointer to wcslen() before any bounds check. If the caller provides a wide-character buffer that is not properly NUL-terminated, wcslen() reads past the end of the buffer until it encounters a NUL wchar, resulting in an out-of-bounds read. Under typical Win32 API usage this requires an abnormal caller contract. Impact is limited to a potential information disclosure from adjacent memory regions or a process crash (denial of service) if the over-read crosses a page boundary.
Title UltraVNC vncWc2Mb calls wcslen() before validating that the wide string is NUL-terminated
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Uvnc Ultravnc
cve-icon MITRE

Status: PUBLISHED

Assigner: securin

Published:

Updated: 2026-07-09T04:36:09.188Z

Reserved: 2026-05-05T03:40:37.003Z

Link: CVE-2026-44041

cve-icon Vulnrichment

Updated: 2026-07-01T13:10:35.463Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-01T13:30:15Z

Weaknesses