DeutschShown in its original language — a full translation is planned for a future version.
UltraVNC: Mehrere Schwachstellen
view advisory published 2026-06-30
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in UltraVNC ausnutzen, um beliebigen Programmcode auszuführen, vertrauliche Informationen offenzulegen, Daten zu manipulieren, und einen Denial of Service zu verursachen.
01
describes (10)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-7840US | — | — | ||
UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embedded HTTP administration server. The functions wi_senderr() and wi_replyhdr() in repeater/webgui/webu… | ||||
| CVE-2026-7839US | —OT elevated | — | ||
UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. In repeater/webgui/settings.c:197, when settings2.txt is absent on f… | ||||
| CVE-2026-7838US | — | — | ||
UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap buffer overflow in the RFB protocol failure-response parsing path. In vncviewer/ClientConnection.cpp,… | ||||
| CVE-2026-7831US | — | — | ||
UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message handler. In vncviewer/ClientConnection.cpp, when the server-supplied name… | ||||
| CVE-2026-7830US | — | — | ||
UltraVNC through 1.8.2.2 uses inadequate cryptography in the MS-Logon II authentication scheme (rfbUltraVNC_MsLogonIIAuth). In rfb/dh.cpp the Diffie-Hellman key exchange is perform… | ||||
| CVE-2026-7829US | — | — | ||
UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In repeater/webgui/settings.c:225-272, after strncpy_s copies a… | ||||
| CVE-2026-7828US | — | — | ||
UltraVNC repeater through 1.8.2.2 contains an integer overflow in the HTTP request logging path. In repeater/webgui/settings.c:336, the win_log() function allocates list nodes via… | ||||
| CVE-2026-44042US | low3.7 | — | ||
UltraVNC repeater through 1.8.2.2 contains an off-by-one error in the Base64 decode helper used for HTTP Basic authentication. In repeater/webgui/webutils.c:817, the wi_uudecode()… | ||||
| CVE-2026-44041US | medium6.5 | — | ||
UltraVNC through 1.8.2.2 contains an out-of-bounds read in the wide-string to multibyte conversion helper. In rfb/dh.cpp:204, the vncWc2Mb() function passes a caller-supplied WCHAR… | ||||
| CVE-2026-44040US | medium6.5 | — | ||
UltraVNC through 1.8.2.2 uses a cryptographically weak pseudo-random number generator to produce VNC authentication challenge bytes. In rfb/vncauth.c:119-129, the vncRandomBytes()… | ||||
02
references
External citations — patches, advisories, analysis.
- EU Vulnerability Database vom 2026-06-30external
- EU Vulnerability Database vom 2026-06-30external
- EU Vulnerability Database vom 2026-06-30external
- EU Vulnerability Database vom 2026-06-30external
- EU Vulnerability Database vom 2026-06-30external
- EU Vulnerability Database vom 2026-06-30external
- EU Vulnerability Database vom 2026-06-30external
- EU Vulnerability Database vom 2026-06-30external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan