CVE-2026-7840— UltraVNC 缓冲区错误漏洞

UltraVNC repeater HTTP server global buffer overflow via long URI (pre-auth RCE)

UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embedded HTTP administration server. The functions wi_senderr() and wi_replyhdr() in repeater/webgui/webutils.c write the caller-supplied HTTP request URI into a fixed 1000-byte global buffer (hdrbuf) via unchecked sprintf calls. The HTTP receive buffer accepts URIs up to approximately 150 KB (WI_RXBUFSIZE = 153600), so an unauthenticated attacker who can reach the repeater HTTP port (default TCP 80) can overflow hdrbuf by at least 500 bytes with a single HTTP request containing a URI of 1500 bytes or longer, corrupting adjacent .bss-segment globals. The overflow occurs before any authentication check, making it reachable without credentials. A remote, unauthenticated attacker can achieve arbitrary code execution on the host running the repeater.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

跨界内存写

UltraVNC 缓冲区错误漏洞

uvnc UltraVNC是uvnc个人开发者开源的一款Windows远程控制软件。 UltraVNC 1.8.2.2及之前版本存在缓冲区错误漏洞，该漏洞源于嵌入式HTTP管理服务器中存在全局缓冲区溢出，函数wi_senderr()和wi_replyhdr()通过未检查的sprintf调用将调用者提供的HTTP请求URI写入固定1000字节的全局缓冲区hdrbuf，可能导致未经身份验证的攻击者通过发送长度至少1500字节的URI的HTTP请求溢出hdrbuf至少500字节，破坏相邻的.bss段全局变量，从

N/A

N/A