Uvnc Ultravnc vulnerabilities

CVE-2019-8269 [HIGH] CWE-121 CVE-2019-8269: UltraVNC revision 1206 has stack-based Buffer overflow vulnerability in VNC client code inside FileT UltraVNC revision 1206 has stack-based Buffer overflow vulnerability in VNC client code inside FileTransfer module, which leads to a denial of service (DoS) condition. This attack appear to be exploitable via network connectivity. This vulnerability has been fixed in revision 1207.

CVE-2026-7830 [HIGH] CWE-326 CVE-2026-7830: UltraVNC through 1.8.2.2 uses inadequate cryptography in the MS-Logon II authentication scheme (rfbU UltraVNC through 1.8.2.2 uses inadequate cryptography in the MS-Logon II authentication scheme (rfbUltraVNC_MsLogonIIAuth). In rfb/dh.cpp the Diffie-Hellman key exchange is performed with parameters that fit in an unsigned 64-bit integer (DH_MAX_BITS controls the prime size). A 64-bit DH key can be broken by Pollard's rho algorithm in under one second o

CVE-2019-8259 [HIGH] CWE-665 CVE-2019-8259: UltraVNC revision 1198 contains multiple memory leaks (CWE-655) in VNC client code, which allow an a UltraVNC revision 1198 contains multiple memory leaks (CWE-655) in VNC client code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appears to be exploitable via network connectivity. These vulnerabilities have

CVE-2019-8277 [HIGH] CWE-665 CVE-2019-8277: UltraVNC revision 1211 contains multiple memory leaks (CWE-665) in VNC server code, which allows an UltraVNC revision 1211 contains multiple memory leaks (CWE-665) in VNC server code, which allows an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appears to be exploitable via network connectivity. These vulnerabilities have

CVE-2019-8276 [HIGH] CWE-121 CVE-2019-8276: UltraVNC revision 1211 has a stack buffer overflow vulnerability in VNC server code inside file tran UltraVNC revision 1211 has a stack buffer overflow vulnerability in VNC server code inside file transfer request handler, which can result in Denial of Service (DoS). This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1212.

CVE-2022-24750 [HIGH] CWE-269 CVE-2022-24750: UltraVNC is a free and open source remote pc access software. A vulnerability has been found in vers UltraVNC is a free and open source remote pc access software. A vulnerability has been found in versions prior to 1.3.8.0 in which the DSM plugin module, which allows a local authenticated user to achieve local privilege escalation (LPE) on a vulnerable system. The vulnerability has been fixed to allow loading of plugins from the installed directory.

CVE-2026-44040 [MEDIUM] CWE-338 CVE-2026-44040: UltraVNC through 1.8.2.2 uses a cryptographically weak pseudo-random number generator to produce VNC UltraVNC through 1.8.2.2 uses a cryptographically weak pseudo-random number generator to produce VNC authentication challenge bytes. In rfb/vncauth.c:119-129, the vncRandomBytes() function seeds libc rand() with time(0) + getpid() + rand() and generates a 16-byte challenge. The combined seed space is approximately 31 bits (libc rand() internal state

CVE-2019-8270 [HIGH] CWE-125 CVE-2019-8270: UltraVNC revision 1210 has out-of-bounds read vulnerability in VNC client code inside Ultra decoder, UltraVNC revision 1210 has out-of-bounds read vulnerability in VNC client code inside Ultra decoder, which results in a denial of service (DoS) condition. This attack appear to be exploitable via network connectivity. This vulnerability has been fixed in revision 1211.

CVE-2019-8267 [HIGH] CWE-125 CVE-2019-8267: UltraVNC revision 1207 has out-of-bounds read vulnerability in VNC client code inside TextChat modul UltraVNC revision 1207 has out-of-bounds read vulnerability in VNC client code inside TextChat module, which results in a denial of service (DoS) condition. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1208.

CVE-2026-4962 [HIGH] CWE-426 CVE-2026-4962: A security flaw has been discovered in UltraVNC up to 1.6.4.0. Affected by this issue is some unknow A security flaw has been discovered in UltraVNC up to 1.6.4.0. Affected by this issue is some unknown functionality in the library version.dll of the component Service. The manipulation results in uncontrolled search path. The attack needs to be approached locally. This attack is characterized by high complexity. The exploitation is known to be difficul

CVE-2026-7828 [MEDIUM] CWE-190 CVE-2026-7828: UltraVNC repeater through 1.8.2.2 contains an integer overflow in the HTTP request logging path. In UltraVNC repeater through 1.8.2.2 contains an integer overflow in the HTTP request logging path. In repeater/webgui/settings.c:336, the win_log() function allocates list nodes via malloc(sizeof(struct LIST) + strlen(line)), where line is derived from HTTP request URIs. If strlen(line) is sufficiently large, the addition overflows to a value smaller tha

CVE-2026-3787 [HIGH] CWE-426 CVE-2026-3787: A weakness has been identified in UltraVNC 1.6.4.0 on Windows. This affects an unknown function in t A weakness has been identified in UltraVNC 1.6.4.0 on Windows. This affects an unknown function in the library cryptbase.dll of the component Windows Service. This manipulation causes uncontrolled search path. The attack requires local access. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The vendor w

CVE-2026-44041 [MEDIUM] CWE-125 CVE-2026-44041: UltraVNC through 1.8.2.2 contains an out-of-bounds read in the wide-string to multibyte conversion h UltraVNC through 1.8.2.2 contains an out-of-bounds read in the wide-string to multibyte conversion helper. In rfb/dh.cpp:204, the vncWc2Mb() function passes a caller-supplied WCHAR pointer to wcslen() before any bounds check. If the caller provides a wide-character buffer that is not properly NUL-terminated, wcslen() reads past the end of the buffer

CVE-2020-37133 [HIGH] CWE-121 CVE-2020-37133: UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in the Repeater Host configurat UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in the Repeater Host configuration field that allows attackers to crash the application. Attackers can paste an overly long string of 300 characters into the Repeater Host property to trigger an application crash.

CVE-2019-8263 [MEDIUM] CWE-121 CVE-2019-8263: UltraVNC revision 1205 has stack-based buffer overflow vulnerability in VNC client code inside ShowC UltraVNC revision 1205 has stack-based buffer overflow vulnerability in VNC client code inside ShowConnInfo routine, which leads to a denial of service (DoS) condition. This attack appear to be exploitable via network connectivity. User interaction is required to trigger this vulnerability. This vulnerability has been fixed in revision 1206.

CVE-2026-44042 [LOW] CWE-193 CVE-2026-44042: UltraVNC repeater through 1.8.2.2 contains an off-by-one error in the Base64 decode helper used for UltraVNC repeater through 1.8.2.2 contains an off-by-one error in the Base64 decode helper used for HTTP Basic authentication. In repeater/webgui/webutils.c:817, the wi_uudecode() function checks whether the input length exceeds the output buffer with a strict greater-than comparison (>), while the correct check should be greater-than-or-equal (>=). Whe

CVE-2020-37132 [MEDIUM] CWE-121 CVE-2020-37132: UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in its password configuration p UltraVNC Launcher 1.2.4.0 contains a denial of service vulnerability in its password configuration properties that allows local attackers to crash the application. Attackers can paste an overly long 300-character string into the password field to trigger an application crash and prevent normal launcher functionality.