Executive brief
UltraVNC Repeater is a tool used to facilitate remote desktop connections between computers, often bypassing network restrictions. A security flaw in its web management interface allows an authenticated administrator to crash the service or take full control of the host system by saving specially crafted access rules. While this requires administrative access, attackers could potentially gain these credentials through other vulnerabilities or default settings, leading to a complete compromise of the remote access infrastructure.
Technical details
An out-of-bounds write vulnerability exists in the UltraVNC Repeater web GUI within 'repeater/webgui/settings.c'. The issue occurs when the 'strncpy_s' function copies rule tokens into stack-allocated arrays (temp1, temp2, or temp3) without subsequent bounds checking. The code unconditionally writes a NUL terminator at an index determined by the input length ('temp1[rule1][len] = 0') without clamping it to the destination buffer size (16 or 25 bytes). An authenticated administrator can exploit this by saving a rule with a token length exceeding the buffer size, causing a stack-based buffer overflow that corrupts adjacent data. This can be leveraged to achieve arbitrary code execution on the host. Attackers may gain the required administrative privileges by exploiting default credentials (CVE-2026-7839).
Affected products
- uvnc UltraVNC Repeater through 1.8.2.2
Timeline
- 2026-07-01: disclosed: CVE published to NVD