CVE-2026-44041

Name of the Vulnerable Software and Affected Versions UltraVNC versions prior to 1.8.2.3

Description An out-of-bounds read exists in the wide-string to multibyte conversion helper. The vncWc2Mb() function in rfb/dh.cpp:204 passes a caller-supplied WCHAR pointer to wcslen() without performing a bounds check. If a wide-character buffer is provided without proper NUL-termination, the system reads past the buffer end until a NUL wchar is found. This can lead to information disclosure from adjacent memory regions or a process crash resulting in a denial of service if the read crosses a page boundary.

Recommendations Update to a version newer than 1.8.2.2.