CVE-2026-7838
UltraVNC viewer heap buffer overflow via integer overflow in RFB connection-failure reason length
Description
UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap buffer overflow in the RFB protocol failure-response parsing path. In vncviewer/ClientConnection.cpp, the 4-byte network-supplied reasonLen field (type CARD32) is passed as reasonLen+1 to CheckBufferSize(). Because both operands are unsigned 32-bit, a reasonLen of 0xFFFFFFFF overflows to 0, causing CheckBufferSize to allocate only 256 bytes. The subsequent ReadString(m_netbuf, reasonLen) call then performs ReadExact for the original 4 GiB length into that 256-byte heap buffer. This overflow is reachable via rfbConnFailed (auth-scheme negotiation) and rfbVncAuthFailed (post-handshake) message types without successful authentication. A malicious VNC server, or any man-in-the-middle on the RFB stream, can trigger this condition when the victim viewer connects, potentially resulting in remote code execution as the user running the viewer. The crash was confirmed with AddressSanitizer on a portable reproduction harness (heap-buffer-overflow WRITE at offset 256).
INFO
Published Date :
July 1, 2026, 5:16 a.m.
Last Modified :
Oct. 25, 2026, 5:10 p.m.
Remotely Exploit :
Yes !
Source :
33c584b5-0579-4c06-b2a0-8d8329fcab9c
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | 33c584b5-0579-4c06-b2a0-8d8329fcab9c | ||||
| CVSS 4.0 | HIGH | 33c584b5-0579-4c06-b2a0-8d8329fcab9c | ||||
| CVSS 4.0 | HIGH | 33c584b5-0579-4c06-b2a0-8d8329fcab9c |
Solution
- Update UltraVNC viewer to a patched version.
- Verify patch installation.
- Monitor for exploit attempts.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-7838.
| URL | Resource |
|---|---|
| https://github.com/ultravnc/UltraVNC | Product |
| https://uvnc.com/ | Product Release Notes |
| https://www.securin.io/zero-days/cve-2026-7838-heap-overflow-viewer-reasonlen-integer-overflow-ultravnc |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-7838 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-7838
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-7838 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-7838 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 25, 2026
Action Type Old Value New Value Added Translation Title: UltraVNC de uvnc, Description: El visor UltraVNC hasta la versión 1.8.2.2 contiene un desbordamiento de entero que conduce a un desbordamiento de búfer de pila en la ruta de análisis de respuestas de fallo del protocolo RFB. En vncviewer/ClientConnection.cpp, el campo reasonLen de 4 bytes suministrado por la red (tipo CARD32) se pasa como reasonLen+1 a CheckBufferSize(). Debido a que ambos operandos son de 32 bits sin signo, un reasonLen de 0xFFFFFFFF se desborda a 0, lo que hace que CheckBufferSize asigne solo 256 bytes. La llamada subsiguiente a ReadString(m_netbuf, reasonLen) luego realiza ReadExact para la longitud original de 4 GiB en ese búfer de pila de 256 bytes. Este desbordamiento es alcanzable a través de los tipos de mensaje rfbConnFailed (negociación del esquema de autenticación) y rfbVncAuthFailed (post-handshake) sin autenticación exitosa. Un servidor VNC malicioso, o cualquier man-in-the-middle en el flujo RFB, puede activar esta condición cuando el visor víctima se conecta, lo que podría resultar en ejecución remota de código como el usuario que ejecuta el visor. El fallo fue confirmado con AddressSanitizer en un arnés de reproducción portátil (desbordamiento de búfer de pila ESCRITURA en el desplazamiento 256). -
CVE Modified by 33c584b5-0579-4c06-b2a0-8d8329fcab9c
Jul. 09, 2026
Action Type Old Value New Value Added Reference https://www.securin.io/zero-days/cve-2026-7838-heap-overflow-viewer-reasonlen-integer-overflow-ultravnc -
Initial Analysis by [email protected]
Jul. 02, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:uvnc:ultravnc:*:*:*:*:*:*:*:* versions up to (including) 1.8.2.2 Added Reference Type securin: https://github.com/ultravnc/UltraVNC Types: Product Added Reference Type securin: https://uvnc.com/ Types: Product, Release Notes -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 01, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-7838', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-01T13:11:26.115793Z'} -
New CVE Received by 33c584b5-0579-4c06-b2a0-8d8329fcab9c
Jul. 01, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'uvnc', 'modules': ['vncviewer'], 'product': 'UltraVNC', 'versions': [{'status': 'affected', 'version': '0', 'versionType': 'custom', 'lessThanOrEqual': '1.8.2.2'}], 'defaultStatus': 'unaffected'}] Added Description UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap buffer overflow in the RFB protocol failure-response parsing path. In vncviewer/ClientConnection.cpp, the 4-byte network-supplied reasonLen field (type CARD32) is passed as reasonLen+1 to CheckBufferSize(). Because both operands are unsigned 32-bit, a reasonLen of 0xFFFFFFFF overflows to 0, causing CheckBufferSize to allocate only 256 bytes. The subsequent ReadString(m_netbuf, reasonLen) call then performs ReadExact for the original 4 GiB length into that 256-byte heap buffer. This overflow is reachable via rfbConnFailed (auth-scheme negotiation) and rfbVncAuthFailed (post-handshake) message types without successful authentication. A malicious VNC server, or any man-in-the-middle on the RFB stream, can trigger this condition when the victim viewer connects, potentially resulting in remote code execution as the user running the viewer. The crash was confirmed with AddressSanitizer on a portable reproduction harness (heap-buffer-overflow WRITE at offset 256). Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Added CWE CWE-787 Added CWE CWE-190 Added Reference https://github.com/ultravnc/UltraVNC Added Reference https://uvnc.com/