An integer overflow occurs in the win_log() function of the UltraVNC repeater when logging HTTP request URIs. The allocation size is computed as sizeof(struct LIST) plus the length of the URI string; if the string length is large enough, the addition overflows and results in a size smaller than the required allocation. The following strcpy then writes the full URI into this undersized buffer, causing a heap buffer overflow. The overflow is limited by the HTTP receive buffer size of 153600 bytes on 32‑bit builds, so only a partial heap write is possible.

The weakness affects the UltraVNC repeater component, specifically the web GUI implementation in repeater/webgui/settings.c. All released versions up to and including 1.8.2.2 are subject to the flaw; no later release or patch information is available in the provided references.

The CVSS score of 5.3 shows a moderate potential impact. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. A remote, unauthenticated attacker can trigger the overflow by sending a very long URI in an HTTP request to the repeater’s HTTP port. The attack vector is network‑based and requires no authentication; exploitation would likely manifest as a denial of service or other memory‑corruption side effects.