Executive brief
UltraVNC is a remote desktop tool used to control computers over a network. A vulnerability in the viewer component allows a malicious server to crash the software or potentially execute unauthorized code when a user attempts to connect to it. This could lead to a denial of service or a compromise of the user's workstation if they are tricked into connecting to a rogue VNC server.
Technical details
An off-by-one stack buffer overflow exists in vncviewer/ClientConnection.cpp within the RFB ServerInit message handler. When a server-supplied nameLength is exactly 2024 bytes, the application allocates a 2024-byte stack buffer (_dn[2024]) and calls ReadString(_dn, 2024). The ReadString function writes a NUL terminator at index 2024, which is one byte beyond the buffer's boundary. On systems without stack canaries, this results in a single-byte NUL overwrite of adjacent stack data; on systems with /GS protection, it triggers a stack canary corruption and immediate process termination (DoS). Exploitation requires the user to initiate a connection to a malicious VNC server.
Affected products
- uvnc UltraVNC Viewer through 1.8.2.2
Timeline
- 2026-07-01: disclosed: CVE published to NVD