Executive brief
UltraVNC Repeater, a tool used to facilitate remote desktop connections through firewalls, contains a minor technical flaw in how it handles login credentials for its web management interface. An attacker could potentially cause a small, controlled memory error by sending a specially crafted login request. While currently difficult to exploit for any significant harm, this flaw represents a latent security risk that could be used to disrupt the service if other system conditions change.
Technical details
An off-by-one error exists in the wi_uudecode() function within repeater/webgui/webutils.c:817. The function utilizes a strict greater-than (>) comparison instead of greater-than-or-equal (>=) when validating if the input length exceeds the output buffer size. This flaw can be triggered via the Authorization header during HTTP Basic authentication. While current HTTP request bounds typically prevent a full buffer overflow, the defect allows a one-byte write at the boundary of a 1024-byte stack buffer. This is considered a latent vulnerability that could lead to a denial of service or limited memory corruption if buffering constraints are modified in future versions.
Affected products
- UltraVNC UltraVNC Repeater through 1.8.2.2
Timeline
- 2026-07-01: disclosed
- 2026-07-01: advisory