CVE-2026-7838Disclosure(uvnc / ultravnc)

RT @HugoValters CVE-2026-7838 - Critical RCE in UltraVNC viewer 1.8.2.2. Integer overflow causes heap buffer overflow in RFB failure-response parsing. CVSS 8.8. No patch available - disable or restrict access now. #CVE #UltraVNC #infosec https://www.valtersit.com/cve/CVE-2026-7838/

🚨High - UltraVNC Viewer Integer Overflow → Heap Buffer Overflow in RFB Failure-Response Parsing (CVE-2026-7838) UltraVNC's viewer mishandles the failure-response path of the RFB protocol. The 4-byte, network-supplied reasonLen field is passed as reasonLen+1 to the buffer-size check; with a value of 0xFFFFFFFF the unsigned math wraps to 0, so only a 256-byte heap buffer is allocated. The code then tries to read the original ~4 GiB length into that tiny buffer — a heap buffer overflow. The bug is reachable pre-authentication via the rfbConnFailed and rfbVncAuthFailed message types, so a malicious VNC server (or a man-in-the-middle on the RFB stream) can trigger it the moment a victim connects, potentially leading to remote code execution as the user running the viewer. Exploitation requires the user to initiate a connection. 👉Affected: UltraVNC Viewer through 1.8.2.2 (no patched release confirmed yet).