CVE-2026-7840

The functions wi_senderr() and wi_replyhdr() in the file repeater/webgui/webutils.c copy the URI identifier from an HTTP request into a fixed, global buffer hdrbuf of 1000 bytes in size using an unsafe sprintf() call — without checking input length. The HTTP receive buffer accepts URIs up to approximately 150 KB in length (WI_RXBUFSIZE = 153600), so a URI of 1500 bytes or longer causes a buffer overflow of at least 500 bytes, overwriting adjacent global variables in the .bss segment. The overflow occurs before any authentication verification is performed, making the vulnerability accessible without any credentials through the default TCP port 80.

A remote, unauthenticated attacker can gain arbitrary code execution (RCE) capability on a host running the UltraVNC Repeater process, leading to complete system compromise.

Security patches available from the vendor should be applied according to the references (https://uvnc.com/ and https://github.com/ultravnc/UltraVNC). Until patches are applied, it is recommended to restrict access to the HTTP repeater port (default TCP 80) exclusively to trusted IP addresses using a firewall or ACL rules, and consider disabling the built-in HTTP administrative interface if it is not essential.

UltraVNC Repeater version 1.8.2.2 and earlier