# CVE-2026-44040: UltraVNC weak PRNG in VNC authentication challenge

Source: https://junglewise.ai/threats/cve-2026-44040-ultravnc-weak-prng-in-vnc-authentication-challenge  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-44040 · Severity: medium · CVSS 4.8 · Published 2026-07-01

UltraVNC, a popular remote desktop tool used for technical support and remote server management, contains a security weakness in how it handles login requests. The software uses a predictable method to generate the security 'challenges' used during authentication, which could allow an attacker to bypass login protections. If exploited, an unauthorized user could potentially gain remote control of the computer, leading to data theft or unauthorized system changes.

Technologies: [UltraVNC](https://junglewise.ai/threats/technologies/ultravnc). Vendors: [UltraVNC](https://junglewise.ai/threats/vendors/ultravnc).

## Quick answers

**Is CVE-2026-44040 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44040 being exploited in the wild.

**How severe is CVE-2026-44040?** Medium severity, with a CVSS score of 4.8, published 1 July 2026.

**Which products and versions are affected?** UltraVNC through 1.8.2.2.

**Is there a fix for CVE-2026-44040?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44040 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-44040?** Check whether you run UltraVNC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

UltraVNC (up to version 1.8.2.2) utilizes a weak PRNG in its authentication handshake. Specifically, in rfb/vncauth.c, the vncRandomBytes() function seeds the standard libc rand() function using a combination of the current time, process ID, and a previous rand() call. This results in a seed space of approximately 31 bits, which is composed entirely of values observable or predictable by a network attacker. By observing an authentication exchange, an attacker can enumerate the seed space within seconds to predict the challenge bytes. This enables the forgery of authentication responses or facilitates efficient offline brute-force attacks against the VNC password. While Windows builds may use a more secure CryptGenRandom path, the reachability of the vulnerable code in official binaries is currently under investigation.

## Affected products

- uvnc UltraVNC through 1.8.2.2

## Timeline

- 2026-07-01: advisory: CVE-2026-44040 published by NVD

## References

- [https://github.com/ultravnc/UltraVNC](https://github.com/ultravnc/UltraVNC)
- [https://uvnc.com/](https://uvnc.com/)

## Related threats

- [UltraVNC viewer heap buffer overflow in RFB failure-response parsing](https://junglewise.ai/threats/cve-2026-7838-ultravnc-viewer-heap-buffer-overflow-in-rfb-failure-response)
- [UltraVNC weak cryptography in MS-Logon II authentication](https://junglewise.ai/threats/cve-2026-7830-ultravnc-weak-cryptography-in-ms-logon-ii-authentication)
- [UltraVNC out-of-bounds read in vncWc2Mb conversion helper](https://junglewise.ai/threats/cve-2026-44041-ultravnc-out-of-bounds-read-in-vncwc2mb-conversion-helper)