CVE-2026-44040

Modified Modified - Updated After Analysis

Weak PRNG in UltraVNC Authentication Challenge

Publication date: 2026-07-01

Last updated on: 2026-07-09

Assigner: securin

Description

UltraVNC through 1.8.2.2 uses a cryptographically weak pseudo-random number generator to produce VNC authentication challenge bytes. In rfb/vncauth.c:119-129, the vncRandomBytes() function seeds libc rand() with time(0) + getpid() + rand() and generates a 16-byte challenge. The combined seed space is approximately 31 bits (libc rand() internal state) and is entirely determined by publicly-observable values (wall-clock time and process ID). An attacker who can observe the authentication exchange can enumerate the seed space and predict the challenge within seconds, enabling forgery or offline brute-forcing of responses. Note: on Windows, the active code path may use vncEncryptBytes2.cpp which calls CryptGenRandom; reachability on shipped Windows binaries requires compile-graph verification and is under investigation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-01

Last Modified

2026-07-09

Generated

2026-07-21

AI Q&A

2026-07-01

EPSS Evaluated

2026-07-20

NVD

CVE-2026-44040

EUVD

EUVD-2026-40879

Affected Vendors & Products

Vendor	Product	Version / Range
uvnc	ultravnc	to 1.8.2.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-338	The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

Attack-Flow Graph

Executive Summary

This vulnerability exists in UltraVNC through version 1.8.2.2, where the software uses a cryptographically weak pseudo-random number generator to create VNC authentication challenge bytes.

Specifically, the function vncRandomBytes() seeds the libc rand() function with a combination of the current time, process ID, and a random number, resulting in a seed space of about 31 bits. Because these seed values are based on publicly observable data, an attacker can predict the challenge bytes by enumerating the seed space.

This predictability allows an attacker who can observe the authentication exchange to forge authentication challenges or perform offline brute-force attacks to guess responses.

Impact Analysis

The vulnerability can allow an attacker to predict authentication challenges in the UltraVNC authentication process.

This enables the attacker to forge authentication challenges or perform offline brute-force attacks to gain unauthorized access.

As a result, unauthorized users could potentially bypass authentication controls, compromising the security of systems using vulnerable UltraVNC versions.

Compliance Impact

The vulnerability in UltraVNC involves the use of a cryptographically weak pseudo-random number generator for producing authentication challenge bytes, which can be predicted by an attacker. This weakness could potentially lead to unauthorized access or data exposure during remote desktop sessions.

Such unauthorized access or data exposure may impact compliance with standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data. If an attacker exploits this vulnerability to gain unauthorized access, it could result in breaches of confidentiality and integrity, thereby violating these regulations.

However, the provided information does not explicitly detail the direct compliance implications or specific regulatory impacts of this vulnerability.

Mitigation Strategies

The vulnerability arises from the use of a cryptographically weak pseudo-random number generator in UltraVNC versions through 1.8.2.2. Immediate mitigation steps include upgrading UltraVNC to a version that addresses this issue or applying patches that replace the weak random number generation with a secure alternative.

Additionally, consider restricting network access to UltraVNC servers to trusted hosts only, and monitor authentication exchanges for suspicious activity to reduce the risk of exploitation.

Hi! I’m here to help you understand CVE-2026-44040. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70