CVE-2026-7831

Name of the Vulnerable Software and Affected Versions UltraVNC viewer versions prior to 1.8.2.3

Description An off-by-one stack buffer overflow exists in the RFB ServerInit message handler within the vncviewer/ClientConnection.cpp file. When a server-supplied nameLength is exactly 2024, the application allocates a 2024-byte stack buffer dn[2024] and calls the ReadString() function. The ReadString() function writes a NUL terminator one byte beyond the end of the buffer at dn[2024]. A malicious VNC server can trigger this by advertising a desktop name of length 2024. In release builds lacking stack canaries, this results in the overwrite of adjacent stack data. In builds utilizing /GS stack protection, the canary is corrupted, leading to a process crash and denial of service. This issue requires the user to connect the viewer to a malicious server.

Recommendations As a temporary mitigation, disable or restrict the use of VNC. At the moment, there is no information about a newer version that contains a fix for this vulnerability.