CVE-2026-7828

UltraVNC repeater integer overflow in win_log malloc leading to heap overflow

Published Jul 1, 2026 CVSS 3.1 · 5.3 Medium EPSS 1.4% KEV · Not listed

Description

UltraVNC repeater through 1.8.2.2 contains an integer overflow in the HTTP request logging path. In repeater/webgui/settings.c:336, the win_log() function allocates list nodes via malloc(sizeof(struct LIST) + strlen(line)), where line is derived from HTTP request URIs. If strlen(line) is sufficiently large, the addition overflows to a value smaller than sizeof(struct LIST), causing a heap allocation smaller than required. The subsequent strcpy of the full string into the undersized allocation produces a heap buffer overflow. In the current implementation this overflow is bounded by the HTTP receive buffer size (WI_RXBUFSIZE = 153600 bytes, well below SIZE_MAX on 32-bit builds), limiting practical exploitability to a partial heap write. A remote unauthenticated attacker can trigger the theoretical overflow path by sending a maximally-sized URI in an HTTP request to the repeater HTTP port.

Analysis

Technical impact

An integer overflow occurs in the win_log() function of the UltraVNC repeater when logging HTTP request URIs. The allocation size is computed as sizeof(struct LIST) plus the length of the URI string; if the string length is large enough, the addition overflows and results in a size smaller than the required allocation. The following strcpy then writes the full URI into this undersized buffer, causing a heap buffer overflow. The overflow is limited by the HTTP receive buffer size of 153600 bytes on 32‑bit builds, so only a partial heap write is possible.

Affected Systems

The weakness affects the UltraVNC repeater component, specifically the web GUI implementation in repeater/webgui/settings.c. All released versions up to and including 1.8.2.2 are subject to the flaw; no later release or patch information is available in the provided references.

Risk and Exploitability

The CVSS score of 5.3 shows a moderate potential impact. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. A remote, unauthenticated attacker can trigger the overflow by sending a very long URI in an HTTP request to the repeater’s HTTP port. The attack vector is network‑based and requires no authentication; exploitation would likely manifest as a denial of service or other memory‑corruption side effects.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

uvnc

UltraVNC

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.8.2.2

Configuration 1 [-]

cpe:2.3:a:uvnc:ultravnc:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Uvnc

Ultravnc

Version	Status	Scheme	Platform
`[0,1.8.2.2]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update UltraVNC to a version released after 1.8.2.2 or apply any vendor‑issued patch that corrects the overflow logic.
Configure the repeater’s HTTP server or use a firewall to reject requests with excessively long URIs or limit the maximum HTTP request size to a value safely below the 153600‑byte boundary.
Enable logging and monitor for abnormal request URI lengths or repeated attempts to send large payloads; investigate any incidents promptly.

Generated by OpenCVE AI on July 1, 2026 at 13:08 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 1.4% (1.352% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/ultravnc/UltraVNC
https://uvnc.com/
https://www.securin.io/zero-days/cve-2026-7828-integer-overflow-win-log-malloc-ultravnc-repeater

History

Jul 9, 2026 5:30 AM Added references View changes

Type	Values Removed	Values Added
References		https://www.securin.io/zero-days/cve-2026-7828-integer-overflow-win-log-malloc-ultravnc-repeater

Jul 1, 2026 3:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Uvnc Uvnc ultravnc
Vendors & Products		Uvnc Uvnc ultravnc

Jul 1, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 1, 2026 5:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		UltraVNC repeater through 1.8.2.2 contains an integer overflow in the HTTP request logging path. In repeater/webgui/settings.c:336, the win_log() function allocates list nodes via malloc(sizeof(struct LIST) + strlen(line)), where line is derived from HTTP request URIs. If strlen(line) is sufficiently large, the addition overflows to a value smaller than sizeof(struct LIST), causing a heap allocation smaller than required. The subsequent strcpy of the full string into the undersized allocation produces a heap buffer overflow. In the current implementation this overflow is bounded by the HTTP receive buffer size (WI_RXBUFSIZE = 153600 bytes, well below SIZE_MAX on 32-bit builds), limiting practical exploitability to a partial heap write. A remote unauthenticated attacker can trigger the theoretical overflow path by sending a maximally-sized URI in an HTTP request to the repeater HTTP port.
Title		UltraVNC repeater integer overflow in win_log malloc leading to heap overflow
Weaknesses		CWE-190
References		https://github.com/ultravnc/UltraVNC https://uvnc.com/
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}`