Description
UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message handler. In vncviewer/ClientConnection.cpp, when the server-supplied nameLength equals exactly 2024 the code declares a 2024-byte stack buffer _dn[2024] and calls ReadString(_dn, 2024). ReadString writes the NUL terminator at buf[length], i.e., _dn[2024], one byte past the end of the stack buffer. A malicious VNC server can trigger this condition by advertising a desktop name of length 2024 in its ServerInit message. On release builds without stack canaries the single-byte NUL overwrite adjacent stack data. On builds with /GS stack protection the canary is corrupted and the process terminates, resulting in denial of service. User interaction (connecting the viewer to the malicious server) is required.
Published: 2026-07-01
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an off-by-one stack buffer overflow in the UltraVNC viewer's handling of the ServerInit message. When the server supplies a desktop name exactly 2024 bytes long, the viewer creates a 2024-byte array on the stack and then writes a null terminator at position 2024, one byte past the buffer. This can corrupt adjacent stack data. In builds without stack canaries the single-byte overwrite can corrupt control data, possibly causing an application crash; in builds with /GS stack protection the canary is corrupted and the process terminates, resulting in denial of service.

Affected Systems

The vulnerability affects UltraVNC viewer versions up to and including 1.8.2.2. Any client that connects to a VNC server that advertises a 2024‑byte desktop name is at risk. All other versions of UltraVNC are unaffected.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity flaw. The EPSS score is not available, and the vulnerability is not yet listed in CISA KEV. The attacker must run a malicious VNC server and the victim must connect to it; no remote code execution is documented, but the exploit leads to a crash or denial of service on the viewer.

Generated by OpenCVE AI on July 1, 2026 at 15:08 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest UltraVNC viewer update that includes the stack overflow fix.
  • Limit VNC connections to trusted servers or networks, and consider disabling VNC entirely if it is not required.
  • If upgrading is not immediately possible, monitor for untrusted servers and watch for viewer crashes, and consider applying stack protection (e.g., compiling with /GS) to force termination rather than allow potential memory corruption.

Generated by OpenCVE AI on July 1, 2026 at 15:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 09 Jul 2026 05:30:00 +0000

Type Values Removed Values Added
References

Wed, 01 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 14:15:00 +0000

Type Values Removed Values Added
First Time appeared Uvnc
Uvnc ultravnc
Vendors & Products Uvnc
Uvnc ultravnc

Wed, 01 Jul 2026 05:00:00 +0000

Type Values Removed Values Added
Description UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message handler. In vncviewer/ClientConnection.cpp, when the server-supplied nameLength equals exactly 2024 the code declares a 2024-byte stack buffer _dn[2024] and calls ReadString(_dn, 2024). ReadString writes the NUL terminator at buf[length], i.e., _dn[2024], one byte past the end of the stack buffer. A malicious VNC server can trigger this condition by advertising a desktop name of length 2024 in its ServerInit message. On release builds without stack canaries the single-byte NUL overwrite adjacent stack data. On builds with /GS stack protection the canary is corrupted and the process terminates, resulting in denial of service. User interaction (connecting the viewer to the malicious server) is required.
Title UltraVNC viewer off-by-one stack overflow in ServerInit desktop name parsing
Weaknesses CWE-193
CWE-787
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H'}

Subscriptions

Uvnc Ultravnc
cve-icon MITRE

Status: PUBLISHED

Assigner: securin

Published:

Updated: 2026-07-09T04:35:54.891Z

Reserved: 2026-05-05T04:03:22.622Z

Link: CVE-2026-7831

cve-icon Vulnrichment

Updated: 2026-07-01T13:12:42.509Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-01T15:15:04Z

Weaknesses