CVE-2026-44041

{
  "id": "CVE-2026-44041",
  "sourceIdentifier": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
  "published": "2026-07-01T05:16:21.033",
  "lastModified": "2026-10-25T17:10:00.197",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "UltraVNC through 1.8.2.2 contains an out-of-bounds read in the wide-string to multibyte conversion helper. In rfb/dh.cpp:204, the vncWc2Mb() function passes a caller-supplied WCHAR pointer to wcslen() before any bounds check. If the caller provides a wide-character buffer that is not properly NUL-terminated, wcslen() reads past the end of the buffer until it encounters a NUL wchar, resulting in an out-of-bounds read. Under typical Win32 API usage this requires an abnormal caller contract. Impact is limited to a potential information disclosure from adjacent memory regions or a process crash (denial of service) if the over-read crosses a page boundary."
    },
    {
      "lang": "es",
      "value": "UltraVNC hasta la versión 1.8.2.2 contiene una lectura fuera de límites en el asistente de conversión de cadena ancha a multibyte. En rfb/dh.cpp:204, la función vncWc2Mb() pasa un puntero WCHAR proporcionado por el llamador a wcslen() antes de cualquier comprobación de límites. Si el llamador proporciona un búfer de caracteres anchos que no está correctamente terminado en NUL, wcslen() lee más allá del final del búfer hasta que encuentra un wchar NUL, lo que resulta en una lectura fuera de límites. Bajo el uso típico de la API de Win32, esto requiere un contrato de llamador anormal. El impacto se limita a una potencial revelación de información de regiones de memoria adyacentes o un fallo del proceso (denegación de servicio) si la lectura excesiva cruza un límite de página."
    }
  ],
  "affected": [
    {
      "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
      "affectedData": [
        {
          "vendor": "uvnc",
          "product": "UltraVNC",
          "defaultStatus": "unaffected",
          "modules": [
            "winvnc",
            "vncviewer"
          ],
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.8.2.2",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-01T13:10:10.152068Z",
          "id": "CVE-2026-44041",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:uvnc:ultravnc:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "1.8.2.2",
              "matchCriteriaId": "593F7EC1-0922-4652-817A-7D57A0F1210D"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ultravnc/UltraVNC",
      "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://uvnc.com/",
      "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://www.securin.io/zero-days/cve-2026-44041-vncwc2mb-wcslen-before-bounds-check-ultravnc",
      "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c"
    }
  ]
}