UltraVNC repeater through 1.8.2.2 contains an off-by-one error in the Base64 decode helper used for HTTP Basic authentication. The wi_uudecode() function only checks if the input length exceeds the output buffer with a > comparison, rather than >=, which could allow a single-byte write past the boundary of a 1024-byte stack buffer when the Authorization header length matches the buffer size. This flaw does not currently lead to a reliable overflow due to existing HTTP request size limits, but the latent condition may become exploitable if those constraints are relaxed. The vulnerability could cause memory corruption or a denial-of-service, but it does not provide an immediate remote code execution path. This weakness is identified as CWE-193.

The affected product is the UltraVNC repeater, as distributed by uvnc:UltraVNC, in all releases up to and including version 1.8.2.2. The security issue resides in the repeater’s webgui/webutils.c file used by the web interface.

The CVSS score is 3.7, indicating a low severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting current exploitation likelihood is very low. Attackers would need to supply a crafted Authorization header that triggers the boundary check, which is unlikely to succeed on its own because the only affected write is one byte and existing request size limits constrain the input. Unless the attacker can modify the repeater’s input handling or increase the header size, no known exploitation mechanism exists. Consequently, the risk for an organization using a vulnerable UltraVNC repeater is limited to a potential memory-corruption–driven stability issue, and no immediate exploitation has been reported.