CVE-2026-7829: UltraVNC Repeater out-of-bounds write in allow/deny rule parser

CVE-2026-7829 · Severity: high · CVSS 7.2 · Published 2026-07-01

UltraVNC Repeater is a tool used to facilitate remote desktop connections between computers, often bypassing network restrictions. A security flaw in its web management interface allows an authenticated administrator to crash the service or take full control of the host system by saving specially crafted access rules. While this requires administrative access, attackers could potentially gain these credentials through other vulnerabilities or default settings, leading to a complete compromise of the remote access infrastructure.

Technologies: UltraVNC Repeater. Vendors: UltraVNC.

Quick answers

Is CVE-2026-7829 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-7829 being exploited in the wild.
How severe is CVE-2026-7829?
High severity, with a CVSS score of 7.2, published 1 July 2026.
Which products and versions are affected?
UltraVNC Repeater through 1.8.2.2.
Is there a fix for CVE-2026-7829?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-7829 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-7829?
Check whether you run UltraVNC Repeater at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds write vulnerability exists in the UltraVNC Repeater web GUI within 'repeater/webgui/settings.c'. The issue occurs when the 'strncpy_s' function copies rule tokens into stack-allocated arrays (temp1, temp2, or temp3) without subsequent bounds checking. The code unconditionally writes a NUL terminator at an index determined by the input length ('temp1[rule1][len] = 0') without clamping it to the destination buffer size (16 or 25 bytes). An authenticated administrator can exploit this by saving a rule with a token length exceeding the buffer size, causing a stack-based buffer overflow that corrupts adjacent data. This can be leveraged to achieve arbitrary code execution on the host. Attackers may gain the required administrative privileges by exploiting default credentials (CVE-2026-7839).

Affected products

  • uvnc UltraVNC Repeater through 1.8.2.2

Timeline

  • 2026-07-01: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.