CVE-2026-44042

{
  "id": "CVE-2026-44042",
  "sourceIdentifier": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
  "published": "2026-07-01T05:16:21.153",
  "lastModified": "2026-10-25T17:10:00.197",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "UltraVNC repeater through 1.8.2.2 contains an off-by-one error in the Base64 decode helper used for HTTP Basic authentication. In repeater/webgui/webutils.c:817, the wi_uudecode() function checks whether the input length exceeds the output buffer with a strict greater-than comparison (>), while the correct check should be greater-than-or-equal (>=). When strlen(authdata) equals sizeof(decode), the decoded output length (approximately 3/4 of input) does not overflow the buffer in current practice because the outer HTTP request bounds constrain the Authorization header. However, the defective check leaves a latent off-by-one condition that could become exploitable if the buffering constraints change. The current risk is limited to a one-byte write at the boundary of a 1024-byte stack buffer under constrained conditions."
    },
    {
      "lang": "es",
      "value": "El repetidor UltraVNC hasta la versión 1.8.2.2 contiene un error de ’off-by-one’ en el asistente de decodificación Base64 utilizado para la autenticación básica HTTP. En repeater/webgui/webutils.c:817, la función wi_uudecode() comprueba si la longitud de entrada excede el búfer de salida con una comparación estricta de ’mayor que’ (>), mientras que la comprobación correcta debería ser ’mayor o igual que’ (>=). Cuando strlen(authdata) es igual a sizeof(decode), la longitud de salida decodificada (aproximadamente 3/4 de la entrada) no desborda el búfer en la práctica actual porque los límites de la solicitud HTTP externa restringen el encabezado de autorización. Sin embargo, la comprobación defectuosa deja una condición latente de ’off-by-one’ que podría volverse explotable si cambian las restricciones de almacenamiento en búfer. El riesgo actual se limita a una escritura de un byte en el límite de un búfer de pila de 1024 bytes bajo condiciones restringidas."
    }
  ],
  "affected": [
    {
      "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
      "affectedData": [
        {
          "vendor": "uvnc",
          "product": "UltraVNC",
          "defaultStatus": "unaffected",
          "modules": [
            "repeater"
          ],
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.8.2.2",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-01T13:08:54.695763Z",
          "id": "CVE-2026-44042",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-193"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:uvnc:ultravnc:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "1.8.2.2",
              "matchCriteriaId": "593F7EC1-0922-4652-817A-7D57A0F1210D"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ultravnc/UltraVNC",
      "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://uvnc.com/",
      "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://www.securin.io/zero-days/cve-2026-44042-wi-uudecode-off-by-one-bounded-ultravnc-repeater",
      "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c"
    }
  ]
}