# CVE-2026-7828: UltraVNC Repeater integer overflow in HTTP request logging

Source: https://junglewise.ai/threats/cve-2026-7828-ultravnc-repeater-integer-overflow-in-http-request-logging  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-7828 · Severity: medium · CVSS 5.3 · Published 2026-07-01

UltraVNC Repeater, a tool used to facilitate remote desktop connections through firewalls, contains a security flaw in its web management interface. An unauthenticated attacker can send a specially crafted web request to the repeater's management port to cause a memory error. While the practical impact is currently limited to a partial system crash or instability, it represents a weakness in how the software handles incoming connection logs.

Technologies: [UltraVNC Repeater](https://junglewise.ai/threats/technologies/repeater). Vendors: [UltraVNC](https://junglewise.ai/threats/vendors/ultravnc).

## Quick answers

**Is CVE-2026-7828 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7828 being exploited in the wild.

**How severe is CVE-2026-7828?** Medium severity, with a CVSS score of 5.3, published 1 July 2026.

**Which products and versions are affected?** UltraVNC Repeater through 1.8.2.2.

**Is there a fix for CVE-2026-7828?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-7828 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-7828?** Check whether you run UltraVNC Repeater at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow exists in the win_log() function within repeater/webgui/settings.c:336 of UltraVNC Repeater. The vulnerability occurs when the function calculates the memory required for a new log entry using malloc(sizeof(struct LIST) + strlen(line)). If the URI-derived 'line' string is sufficiently long, the addition overflows, resulting in a heap allocation smaller than the actual data. A subsequent strcpy() operation then writes the full string into the undersized buffer, causing a heap buffer overflow. While the overflow is currently bounded by the 153,600-byte HTTP receive buffer (WI_RXBUFSIZE), it allows for a partial heap write by a remote unauthenticated attacker. Version 1.8.2.4 appears to be available as a newer release, though the advisory specifically notes the flaw through 1.8.2.2.

## Affected products

- UltraVNC UltraVNC Repeater through 1.8.2.2

## Timeline

- 2026-07-01: advisory: CVE-2026-7828 published by NVD

## References

- [https://github.com/ultravnc/UltraVNC](https://github.com/ultravnc/UltraVNC)
- [https://uvnc.com/](https://uvnc.com/)

## Related threats

- [UltraVNC Repeater hardcoded password in HTTP administration server](https://junglewise.ai/threats/cve-2026-7839-ultravnc-repeater-hardcoded-password-in-http-administration-server)
- [UltraVNC Repeater out-of-bounds write in allow/deny rule parser](https://junglewise.ai/threats/cve-2026-7829-ultravnc-repeater-out-of-bounds-write-in-allow-deny-rule-parser)
- [UltraVNC Repeater off-by-one error in HTTP Basic authentication](https://junglewise.ai/threats/cve-2026-44042-ultravnc-repeater-off-by-one-error-in-http-basic-authentication)