CVE-2026-7828

Name of the Vulnerable Software and Affected Versions UltraVNC repeater versions prior to 1.8.2.3

Description An integer overflow exists in the HTTP request logging path. The win log() function allocates list nodes using a calculation based on the length of the HTTP request URI. If the URI length is sufficiently large, the addition overflows, resulting in a heap allocation smaller than required. A subsequent strcpy() operation then causes a heap buffer overflow. This overflow is bounded by the HTTP receive buffer size, which limits practical exploitation to a partial heap write. A remote unauthenticated attacker can trigger this path by sending a maximally-sized URI in an HTTP request to the repeater HTTP port.

Recommendations Update to a version newer than 1.8.2.2.