Executive brief
UltraVNC Repeater, a tool used to facilitate remote desktop connections through firewalls, contains a security flaw in its web management interface. An unauthenticated attacker can send a specially crafted web request to the repeater's management port to cause a memory error. While the practical impact is currently limited to a partial system crash or instability, it represents a weakness in how the software handles incoming connection logs.
Technical details
An integer overflow exists in the win_log() function within repeater/webgui/settings.c:336 of UltraVNC Repeater. The vulnerability occurs when the function calculates the memory required for a new log entry using malloc(sizeof(struct LIST) + strlen(line)). If the URI-derived 'line' string is sufficiently long, the addition overflows, resulting in a heap allocation smaller than the actual data. A subsequent strcpy() operation then writes the full string into the undersized buffer, causing a heap buffer overflow. While the overflow is currently bounded by the 153,600-byte HTTP receive buffer (WI_RXBUFSIZE), it allows for a partial heap write by a remote unauthenticated attacker. Version 1.8.2.4 appears to be available as a newer release, though the advisory specifically notes the flaw through 1.8.2.2.
Affected products
- UltraVNC UltraVNC Repeater through 1.8.2.2
Timeline
- 2026-07-01: advisory: CVE-2026-7828 published by NVD