Executive brief
UltraVNC is a remote desktop tool used to control computers over a network. A security flaw in how the software handles certain text conversions could allow an attacker to crash the application or potentially view small amounts of private information from the computer's memory. This could disrupt remote support operations or lead to limited data exposure.
Technical details
An out-of-bounds read vulnerability exists in UltraVNC versions up to 1.8.2.2 within the vncWc2Mb() function in rfb/dh.cpp. The root cause is the function passing a caller-supplied WCHAR pointer to wcslen() before performing any bounds checking. If an attacker provides a wide-character buffer that lacks proper NUL-termination, wcslen() will read past the buffer's end until it encounters a NUL wchar. This can result in an information disclosure of adjacent memory or a process crash (DoS) if the read operation crosses a memory page boundary. While the vendor has released version 1.8.2.4, users should verify if this specific issue is addressed in the latest release.
Affected products
- UltraVNC UltraVNC through 1.8.2.2
Timeline
- 2026-07-01: advisory: Vulnerability published in NVD