# CVE-2026-7831: UltraVNC Viewer off-by-one stack buffer overflow in RFB handler

Source: https://junglewise.ai/threats/cve-2026-7831-ultravnc-viewer-off-by-one-stack-buffer-overflow-in-rfb-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-7831 · Severity: high · CVSS 7.6 · Published 2026-07-01

UltraVNC is a remote desktop tool used to control computers over a network. A vulnerability in the viewer component allows a malicious server to crash the software or potentially execute unauthorized code when a user attempts to connect to it. This could lead to a denial of service or a compromise of the user's workstation if they are tricked into connecting to a rogue VNC server.

Vendors: [UltraVNC](https://junglewise.ai/threats/vendors/ultravnc).

## Quick answers

**Is CVE-2026-7831 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7831 being exploited in the wild.

**How severe is CVE-2026-7831?** High severity, with a CVSS score of 7.6, published 1 July 2026.

**Which products and versions are affected?** UltraVNC Viewer through 1.8.2.2.

**Is there a fix for CVE-2026-7831?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-7831 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-7831?** Check whether you run UltraVNC Viewer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An off-by-one stack buffer overflow exists in vncviewer/ClientConnection.cpp within the RFB ServerInit message handler. When a server-supplied nameLength is exactly 2024 bytes, the application allocates a 2024-byte stack buffer (_dn[2024]) and calls ReadString(_dn, 2024). The ReadString function writes a NUL terminator at index 2024, which is one byte beyond the buffer's boundary. On systems without stack canaries, this results in a single-byte NUL overwrite of adjacent stack data; on systems with /GS protection, it triggers a stack canary corruption and immediate process termination (DoS). Exploitation requires the user to initiate a connection to a malicious VNC server.

## Affected products

- uvnc UltraVNC Viewer through 1.8.2.2

## Timeline

- 2026-07-01: disclosed: CVE published to NVD

## References

- [https://github.com/ultravnc/UltraVNC](https://github.com/ultravnc/UltraVNC)
- [https://uvnc.com/](https://uvnc.com/)

## Related threats

- [TightVNC and UltraVNC heap-based buffer overflow in Tight JPEG decoding](https://junglewise.ai/threats/cve-2026-128321-tight-jpeg-decoding-in-tightvnc-and-ultravnc-viewers-contains-a)