Quick answers
- Is CVE-2026-44040 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-44040 being exploited in the wild.
- How severe is CVE-2026-44040?
- Medium severity, with a CVSS score of 4.8, published 1 July 2026.
- Which products and versions are affected?
- UltraVNC through 1.8.2.2.
- Is there a fix for CVE-2026-44040?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-44040 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-44040?
- Check whether you run UltraVNC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
UltraVNC (up to version 1.8.2.2) utilizes a weak PRNG in its authentication handshake. Specifically, in rfb/vncauth.c, the vncRandomBytes() function seeds the standard libc rand() function using a combination of the current time, process ID, and a previous rand() call. This results in a seed space of approximately 31 bits, which is composed entirely of values observable or predictable by a network attacker. By observing an authentication exchange, an attacker can enumerate the seed space within seconds to predict the challenge bytes. This enables the forgery of authentication responses or facilitates efficient offline brute-force attacks against the VNC password. While Windows builds may use a more secure CryptGenRandom path, the reachability of the vulnerable code in official binaries is currently under investigation.
Affected products
- uvnc UltraVNC through 1.8.2.2
Timeline
- 2026-07-01: advisory: CVE-2026-44040 published by NVD