The UltraVNC Repeater, version 1.8.2.2, contains a global buffer overflow in its embedded HTTP administration server. The functions wi_senderr() and wi_replyhdr() copy the request URI into a fixed 1,000‑byte global buffer via unchecked sprintf calls. Because the HTTP receive buffer accepts URIs up to approximately 150 KB, an unauthenticated attacker who can reach the repeater’s HTTP port can overflow the buffer by at least 500 bytes with a single request containing a URI of 1,500 bytes or longer, corrupting adjacent .bss‑segment globals. The overflow occurs before any authentication check, enabling remote, unauthenticated arbitrary code execution on the host.

Affected systems are installations of UltraVNC Repeater running version 1.8.2.2 or earlier that have the HTTP administration interface enabled. The vulnerability resides in the repeater’s built‑in HTTP server, which listens on default port 80. No other vendors or product versions are known to be affected by this specific buffer overflow.

Using the CVSS 9.3 score, this vulnerability is classified as Critical. The EPSS score of 1 % indicates a low but non‑zero likelihood of exploitation. The flaw is not yet listed in the CISA KEV catalog, but it can be leveraged without credentials over the Internet or any network that allows access to port 80. Given the remote, unauthenticated nature of the attack and the high severity of the impact, administrators should treat this as the highest priority issue.