CVE-2026-44041
UltraVNC vncWc2Mb calls wcslen() before validating that the wide string is NUL-terminated
Description
UltraVNC through 1.8.2.2 contains an out-of-bounds read in the wide-string to multibyte conversion helper. In rfb/dh.cpp:204, the vncWc2Mb() function passes a caller-supplied WCHAR pointer to wcslen() before any bounds check. If the caller provides a wide-character buffer that is not properly NUL-terminated, wcslen() reads past the end of the buffer until it encounters a NUL wchar, resulting in an out-of-bounds read. Under typical Win32 API usage this requires an abnormal caller contract. Impact is limited to a potential information disclosure from adjacent memory regions or a process crash (denial of service) if the over-read crosses a page boundary.
INFO
Published Date :
July 1, 2026, 3:33 a.m.
Last Modified :
July 1, 2026, 3:33 a.m.
Remotely Exploit :
Yes !
Source :
securin
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | 33c584b5-0579-4c06-b2a0-8d8329fcab9c |
Solution
- Update UltraVNC to the latest stable version.
- Ensure wide-character buffers are properly NUL-terminated.
- Apply security patches provided by the vendor.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-44041 vulnerability anywhere in the article.