CVE-2026-7838

Name of the Vulnerable Software and Affected Versions UltraVNC viewer versions prior to 1.8.2.3

Description An integer overflow exists in the RFB protocol failure-response parsing path within the vncviewer/ClientConnection.cpp file. The issue occurs when the 4-byte network-supplied reasonLen field is passed as reasonLen+1 to the CheckBufferSize() function. If reasonLen is 0xFFFFFFFF, the unsigned 32-bit addition overflows to 0, leading the system to allocate only 256 bytes. Subsequently, the ReadString() function calls ReadExact() to read the original 4 GiB length into the small 256-byte heap buffer, resulting in a heap buffer overflow. This condition can be triggered pre-authentication via rfbConnFailed (auth-scheme negotiation) and rfbVncAuthFailed (post-handshake) message types. A malicious VNC server or a man-in-the-middle attacker on the RFB stream can exploit this when a victim connects, potentially leading to remote code execution as the user running the viewer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the RFB stream to minimize the risk of exploitation.