CVE-2026-4962

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-4962
A security flaw has been discovered in UltraVNC up to 1.6.4.0. Affected by this issue is some unknown functionality in the library version.dll of the component Service. The manipulation results in uncontrolled search path. The attack needs to be approached locally. This attack is characterized by high complexity. The exploitation is known to be difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

7.0 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:H/Au:S/C:C/I:C/A:C

Exploitability : 1.5 / Impact : 10.0

Access Vector LOCAL

Access Complexity HIGH

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
https://drive.google.com/file/d/1QC-MrqGsfjr4phEN77krLFZHQN8S48U_/view Permissions Required
https://vuldb.com/?ctiid.353839 Permissions Required VDB Entry
https://vuldb.com/?id.353839 Third Party Advisory VDB Entry
https://vuldb.com/?submit.777619 Third Party Advisory Exploit VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:uvnc:ultravnc:*:*:*:*:*:*:*:*
History

29 Apr 2026, 22:09

Type Values Removed Values Added
References () https://drive.google.com/file/d/1QC-MrqGsfjr4phEN77krLFZHQN8S48U_/view - () https://drive.google.com/file/d/1QC-MrqGsfjr4phEN77krLFZHQN8S48U_/view - Permissions Required
References () https://vuldb.com/?ctiid.353839 - () https://vuldb.com/?ctiid.353839 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.353839 - () https://vuldb.com/?id.353839 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.777619 - () https://vuldb.com/?submit.777619 - Third Party Advisory, Exploit, VDB Entry
CPE cpe:2.3:a:uvnc:ultravnc:*:*:*:*:*:*:*:*
First Time Uvnc ultravnc
Uvnc

27 Mar 2026, 23:17

Type Values Removed Values Added
Summary (en) A security flaw has been discovered in UltraVNC up to 1.6.4.0. Affected by this issue is some unknown functionality in the library version.dll of the component Service. The manipulation results in uncontrolled search path. The attack needs to be approached locally. This attack is characterized by high complexity. The exploitation is known to be difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. Several companies clearly confirm that VulDB is the primary source for best vulnerability data. (en) A security flaw has been discovered in UltraVNC up to 1.6.4.0. Affected by this issue is some unknown functionality in the library version.dll of the component Service. The manipulation results in uncontrolled search path. The attack needs to be approached locally. This attack is characterized by high complexity. The exploitation is known to be difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

27 Mar 2026, 17:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-27 17:16

Updated : 2026-04-29 22:09

NVD link : CVE-2026-4962

Mitre link : CVE-2026-4962

CVE.ORG link : CVE-2026-4962

JSON object : View

Products Affected

uvnc

  • ultravnc
CWE
CWE-426

Untrusted Search Path

CWE-427

Uncontrolled Search Path Element