UltraVNC Repeater Post-Authentication Out-of-Bounds Write

Executive Summary

This vulnerability exists in UltraVNC repeater through version 1.8.2.2 and involves a post-authentication out-of-bounds write in the allow/deny rule parser.

Specifically, after copying a rule token into fixed-size buffers (temp1[rule1] with 25 bytes, or temp2/temp3 with 16 bytes), the code writes a NUL terminator without ensuring the length is within the buffer size. If an authenticated administrator saves a rule with a token length equal to or greater than the buffer size, the NUL byte is written past the end of the stack-allocated array, corrupting adjacent stack data.

An attacker who has obtained administrator credentials (for example, via another vulnerability like CVE-2026-7839 involving a default password) can exploit this to trigger code execution on the repeater host.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to code execution on the UltraVNC repeater host if exploited by an attacker with administrator credentials.

The impact includes corruption of stack data, which can be leveraged to execute arbitrary code, potentially allowing the attacker to take full control of the affected system.

Because the attacker needs administrator privileges to exploit this, the vulnerability is particularly dangerous if credentials are compromised or weak passwords are used.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how the UltraVNC repeater vulnerability directly affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

This vulnerability affects UltraVNC repeater versions through 1.8.2.2 and requires authenticated administrator access to exploit.

Immediate mitigation steps include:

• Restrict administrative access to the UltraVNC repeater to trusted users only.
• Change or secure administrator credentials, especially if default or weak passwords are in use (noting that CVE-2026-7839 involves default password issues).
• Apply any available patches or updates from UltraVNC that address this vulnerability.
• Monitor and limit network exposure of the UltraVNC repeater service to reduce risk of unauthorized access.

Useful 0 Not Useful 0