Executive brief
UltraVNC Repeater, a tool used to facilitate remote desktop connections through firewalls, contains a critical security flaw in its web-based administration interface. An unauthenticated attacker can send a specially crafted web request to take complete control of the server running the software. This could lead to a total compromise of the system, unauthorized access to remote sessions, and a foothold for further attacks within the corporate network.
Technical details
A global buffer overflow exists in the embedded HTTP administration server of UltraVNC Repeater through version 1.8.2.2. The vulnerability is located in the wi_senderr() and wi_replyhdr() functions within repeater/webgui/webutils.c, which use unchecked sprintf calls to write the HTTP request URI into a fixed 1000-byte global buffer (hdrbuf). While the buffer is small, the HTTP receive buffer accepts URIs up to 150 KB, allowing an unauthenticated remote attacker to overflow the buffer by sending a URI longer than 1500 bytes. This results in the corruption of adjacent .bss-segment globals and can be leveraged to achieve arbitrary code execution. The flaw is reachable on the default TCP port 80 before any authentication checks occur.
Affected products
- UltraVNC UltraVNC Repeater through 1.8.2.2
Timeline
- 2026-07-01: advisory: NVD publication date