UltraVNC viewer 1.8.2.2 contains an integer overflow (CWE-190) in the RFB connection‑f heap-based buffer overflow (CWE-787). The 4‑byte reasonLen value,0xFFFFFFFF by a malicious VNC server or a man‑in, overflows to 0 and causes the client to allocate only 256 bytes. The subsequent read then copies the original 4 GiB reason into that small buffer, allowing arbitrary memory writes on the machine running the viewer. This flaw is reachable before authentication via the rfbConnFailed and rfbVncAuth it a high‑impact remote code execution vector.

UltraVNC viewer up to and including version 1.8.2.2, to an RFB server over the in the vncviewer/ClientConnection.cpp module that parses RFB failure responses.

The CVSS score of 8.7 indicates high severity. EPSS score of 1% indicates the likelihood of exploitation is low but non‑zero, but the flaw can be triggered without authentication. It is not listed in CISA’s KEV catalog, meaning no reported yet. A client connecting to a overflow, potentially leading to remote code execution on the local user’s system.