CVE-2026-7831

UltraVNC viewer off-by-one stack overflow in ServerInit desktop name parsing

Published Jul 1, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message handler. In vncviewer/ClientConnection.cpp, when the server-supplied nameLength equals exactly 2024 the code declares a 2024-byte stack buffer _dn[2024] and calls ReadString(_dn, 2024). ReadString writes the NUL terminator at buf[length], i.e., _dn[2024], one byte past the end of the stack buffer. A malicious VNC server can trigger this condition by advertising a desktop name of length 2024 in its ServerInit message. On release builds without stack canaries the single-byte NUL overwrite adjacent stack data. On builds with /GS stack protection the canary is corrupted and the process terminates, resulting in denial of service. User interaction (connecting the viewer to the malicious server) is required.

Analysis

Technical impact

The vulnerability is an off-by-one stack buffer overflow in the UltraVNC viewer's handling of the ServerInit message. When the server supplies a desktop name exactly 2024 bytes long, the viewer creates a 2024-byte array on the stack and then writes a null terminator at position 2024, one byte past the buffer. This can corrupt adjacent stack data. In builds without stack canaries the single-byte overwrite can corrupt control data, possibly causing an application crash; in builds with /GS stack protection the canary is corrupted and the process terminates, resulting in denial of service.

Affected Systems

The vulnerability affects UltraVNC viewer versions up to and including 1.8.2.2. Any client that connects to a VNC server that advertises a 2024‑byte desktop name is at risk. All other versions of UltraVNC are unaffected.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity flaw. The EPSS score is not available, and the vulnerability is not yet listed in CISA KEV. The attacker must run a malicious VNC server and the victim must connect to it; no remote code execution is documented, but the exploit leads to a crash or denial of service on the viewer.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

uvnc

UltraVNC

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.8.2.2

Configuration 1 [-]

cpe:2.3:a:uvnc:ultravnc:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Uvnc

Ultravnc

Version	Status	Scheme	Platform
`[0,1.8.2.2]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest UltraVNC viewer update that includes the stack overflow fix.
Limit VNC connections to trusted servers or networks, and consider disabling VNC entirely if it is not required.
If upgrading is not immediately possible, monitor for untrusted servers and watch for viewer crashes, and consider applying stack protection (e.g., compiling with /GS) to force termination rather than allow potential memory corruption.

Generated by OpenCVE AI on July 1, 2026 at 15:08 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.738% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/ultravnc/UltraVNC
https://uvnc.com/
https://www.securin.io/zero-days/cve-2026-7831-off-by-one-stack-overflow-viewer-namelength-ultravnc

History

Jul 9, 2026 5:30 AM Added references View changes

Type	Values Removed	Values Added
References		https://www.securin.io/zero-days/cve-2026-7831-off-by-one-stack-overflow-viewer-namelength-ultravnc

Jul 1, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 1, 2026 2:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Uvnc Uvnc ultravnc
Vendors & Products		Uvnc Uvnc ultravnc

Jul 1, 2026 5:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message handler. In vncviewer/ClientConnection.cpp, when the server-supplied nameLength equals exactly 2024 the code declares a 2024-byte stack buffer _dn[2024] and calls ReadString(_dn, 2024). ReadString writes the NUL terminator at buf[length], i.e., _dn[2024], one byte past the end of the stack buffer. A malicious VNC server can trigger this condition by advertising a desktop name of length 2024 in its ServerInit message. On release builds without stack canaries the single-byte NUL overwrite adjacent stack data. On builds with /GS stack protection the canary is corrupted and the process terminates, resulting in denial of service. User interaction (connecting the viewer to the malicious server) is required.
Title		UltraVNC viewer off-by-one stack overflow in ServerInit desktop name parsing
Weaknesses		CWE-193 CWE-787
References		https://github.com/ultravnc/UltraVNC https://uvnc.com/
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H'}`