UltraVNC Repeater Post-Authentication Out-of-Bounds Write

Executive Summary

This vulnerability exists in UltraVNC repeater through version 1.8.2.2 and involves a post-authentication out-of-bounds write in the allow/deny rule parser.

Specifically, after copying a rule token into fixed-size buffers (temp1[rule1] with 25 bytes, or temp2/temp3 with 16 bytes), the code writes a NUL terminator without ensuring the length is within the buffer size. If an authenticated administrator saves a rule with a token length equal to or greater than the buffer size, the NUL byte is written past the end of the stack-allocated array, corrupting adjacent stack data.

An attacker who has obtained administrator credentials (for example, via another vulnerability like CVE-2026-7839 involving a default password) can exploit this to trigger code execution on the repeater host.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to code execution on the UltraVNC repeater host if exploited by an attacker with administrator credentials.

The impact includes corruption of stack data, which can be leveraged to execute arbitrary code, potentially allowing the attacker to take full control of the affected system.

Because the attacker needs administrator privileges to exploit this, the vulnerability is particularly dangerous if credentials are compromised or weak passwords are used.

Useful 0 Not Useful 0