CVE-2026-7838
Full vulnerability record from the local CVENow database.
Description
UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap buffer overflow in the RFB protocol failure-response parsing path. In vncviewer/ClientConnection.cpp, the 4-byte network-supplied reasonLen field (type CARD32) is passed as reasonLen+1 to CheckBufferSize(). Because both operands are unsigned 32-bit, a reasonLen of 0xFFFFFFFF overflows to 0, causing CheckBufferSize to allocate only 256 bytes. The subsequent ReadString(m_netbuf, reasonLen) call then performs ReadExact for the original 4 GiB length into that 256-byte heap buffer. This overflow is reachable via rfbConnFailed (auth-scheme negotiation) and rfbVncAuthFailed (post-handshake) message types without successful authentication. A malicious VNC server, or any man-in-the-middle on the RFB stream, can trigger this condition when the victim viewer connects, potentially resulting in remote code execution as the user running the viewer. The crash was confirmed with AddressSanitizer on a portable reproduction harness (heap-buffer-overflow WRITE at offset 256).
Severity
HIGH
CVSS score
8.7
(v4.0)
Vulnerability status
Modified
Source identifier
33c584b5-0579-4c06-b2a0-8d8329fcab9c
Published
2026-07-01 05:16:24.540000
Last modified
2026-10-25 17:10:00.197000
View original CVE JSON
{
"id": "CVE-2026-7838",
"sourceIdentifier": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"published": "2026-07-01T05:16:24.540",
"lastModified": "2026-10-25T17:10:00.197",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap buffer overflow in the RFB protocol failure-response parsing path. In vncviewer/ClientConnection.cpp, the 4-byte network-supplied reasonLen field (type CARD32) is passed as reasonLen+1 to CheckBufferSize(). Because both operands are unsigned 32-bit, a reasonLen of 0xFFFFFFFF overflows to 0, causing CheckBufferSize to allocate only 256 bytes. The subsequent ReadString(m_netbuf, reasonLen) call then performs ReadExact for the original 4 GiB length into that 256-byte heap buffer. This overflow is reachable via rfbConnFailed (auth-scheme negotiation) and rfbVncAuthFailed (post-handshake) message types without successful authentication. A malicious VNC server, or any man-in-the-middle on the RFB stream, can trigger this condition when the victim viewer connects, potentially resulting in remote code execution as the user running the viewer. The crash was confirmed with AddressSanitizer on a portable reproduction harness (heap-buffer-overflow WRITE at offset 256)."
},
{
"lang": "es",
"value": "El visor UltraVNC hasta la versión 1.8.2.2 contiene un desbordamiento de entero que conduce a un desbordamiento de búfer de pila en la ruta de análisis de respuestas de fallo del protocolo RFB. En vncviewer/ClientConnection.cpp, el campo reasonLen de 4 bytes suministrado por la red (tipo CARD32) se pasa como reasonLen+1 a CheckBufferSize(). Debido a que ambos operandos son de 32 bits sin signo, un reasonLen de 0xFFFFFFFF se desborda a 0, lo que hace que CheckBufferSize asigne solo 256 bytes. La llamada subsiguiente a ReadString(m_netbuf, reasonLen) luego realiza ReadExact para la longitud original de 4 GiB en ese búfer de pila de 256 bytes. Este desbordamiento es alcanzable a través de los tipos de mensaje rfbConnFailed (negociación del esquema de autenticación) y rfbVncAuthFailed (post-handshake) sin autenticación exitosa. Un servidor VNC malicioso, o cualquier man-in-the-middle en el flujo RFB, puede activar esta condición cuando el visor víctima se conecta, lo que podría resultar en ejecución remota de código como el usuario que ejecuta el visor. El fallo fue confirmado con AddressSanitizer en un arnés de reproducción portátil (desbordamiento de búfer de pila ESCRITURA en el desplazamiento 256)."
}
],
"affected": [
{
"source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"affectedData": [
{
"vendor": "uvnc",
"product": "UltraVNC",
"defaultStatus": "unaffected",
"modules": [
"vncviewer"
],
"versions": [
{
"version": "0",
"lessThanOrEqual": "1.8.2.2",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-01T13:11:26.115793Z",
"id": "CVE-2026-7838",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-190"
},
{
"lang": "en",
"value": "CWE-787"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:uvnc:ultravnc:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.8.2.2",
"matchCriteriaId": "593F7EC1-0922-4652-817A-7D57A0F1210D"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/ultravnc/UltraVNC",
"source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"tags": [
"Product"
]
},
{
"url": "https://uvnc.com/",
"source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
"tags": [
"Product",
"Release Notes"
]
},
{
"url": "https://www.securin.io/zero-days/cve-2026-7838-heap-overflow-viewer-reasonlen-integer-overflow-ultravnc",
"source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c"
}
]
}