UltraVNC repeater authenticated out-of-bounds write in rule parser via oversized token

published 2026-07-01 4 mo ago modified 2026-10-25 14 d ago also EUVD-2026-40881

cvss: 7.2; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.9%; EPSS 0.9% chance of exploitation in 30 days, percentile 58%
public exploits: 0; none known

UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In repeater/webgui/settings.c:225-272, after strncpy_s copies a rule token into temp1[rule1] (25-byte destination) or temp2/temp3 (16-byte destination), the code unconditionally writes a NUL terminator at temp1[rule1][len] = 0 without clamping len to the destination size. When an authenticated administrator saves a rule with a token length equal to or greater than the destination size, the NUL byte is written one or more bytes past the end of the stack-allocated array, corrupting adjacent stack data. An attacker who has obtained admin credentials (including via CVE-2026-7839 default password) can trigger this to gain code execution on the repeater host.

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 4 mo ago (2026-07-01)

Exploit prediction

0.85% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

uvnc UltraVNC

Classification

Weakness

CWE-787 Out-of-bounds Write

References

uvnc.com /
vendor-advisory, product, release-notes
github.com /ultravnc/UltraVNC
product
securin.io /zero-days/cve-2026-7829-post-auth-oob-nul-write-repeater-rule-parser-ultravnc

Sources

CVE List CVE-2026-7829
NVD CVE-2026-7829

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary