CVE-2026-7840

Name of the Vulnerable Software and Affected Versions UltraVNC repeater versions prior to 1.8.2.3

Description The embedded HTTP administration server contains a global buffer overflow. The functions wi senderr() and wi replyhdr() in repeater/webgui/webutils.c write the HTTP request URI into a fixed 1000-byte global buffer hdrbuf using unchecked sprintf calls. Because the HTTP receive buffer allows URIs up to approximately 150 KB, an unauthenticated remote attacker can overflow hdrbuf by sending a request with a URI of 1500 bytes or longer. This process corrupts adjacent .bss-segment globals (a section of memory used for uninitialized global variables) before authentication occurs, potentially allowing arbitrary code execution on the host.

Recommendations Update UltraVNC repeater to a version newer than 1.8.2.2.