An authenticated administrator can configure a rule with a token longer than the 25-byte or 16-byte buffers used by the repeater’s rule parser. The routine calls strncpy_s to copy the token but then unconditionally writes a terminating NUL byte past the end of the stack buffer, creating an out‑of‑bounds write (CWE‑787). If exploited, an attacker can corrupt adjacent stack data and gain arbitrary code execution on the repeater host.

The flaw is present in UltraVNC version 1.8.2.2 and earlier releases, as shipped by uvnc:UltraVNC. Any system that runs this version of the repeater and accepts rule definitions through the web GUI or administrative clients is vulnerable.

The CVSS score of 7.2 indicates high severity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog, implying that a public exploit has not yet been reported. Nevertheless, the vulnerability is post‑authentication; an attacker who has obtained administrator credentials—either via the default CVE‑2026‑7839 password or by compromising existing accounts—can create a malicious rule and trigger the out‑of‑bounds write, thus executing arbitrary code on the host.