CVE-2026-44040

Name of the Vulnerable Software and Affected Versions UltraVNC versions prior to 1.8.2.3

Description The software uses a cryptographically weak pseudo-random number generator to produce VNC authentication challenge bytes. Specifically, the vncRandomBytes() function seeds libc rand() using a combination of wall-clock time, process ID, and a previous random value to generate a 16-byte challenge. Because the seed space is approximately 31 bits and relies on publicly observable values, an attacker monitoring the authentication exchange can predict the challenge quickly, allowing for response forgery or offline brute-forcing.

Recommendations Update UltraVNC to a version newer than 1.8.2.2. As a temporary mitigation, restrict network access to the VNC service to trusted hosts only to prevent attackers from observing the authentication exchange.