CVE-2026-7831

UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message handler. In vncviewer/ClientConnection.cpp, when the server-supplied nameLength equals exactly 2024 the code declares a 2024-byte stack buffer _dn[2024] and calls ReadString(_dn, 2024). ReadString writes the NUL terminator at buf[length], i.e., _dn[2024], one byte past the end of the stack buffer. A malicious VNC server can trigger this condition by advertising a desktop name of length 2024 in its ServerInit message. On release builds without stack canaries the single-byte NUL overwrite adjacent stack data. On builds with /GS stack protection the canary is corrupted and the process terminates, resulting in denial of service. User interaction (connecting the viewer to the malicious server) is required.

CVSS v3 7.6 HIGH

7.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/ultravnc/UltraVNC	Product
https://uvnc.com/	Product Release Notes
https://www.securin.io/zero-days/cve-2026-7831-off-by-one-stack-overflow-viewer-namelength-ultravnc

Configurations

Configuration 1 (hide)

cpe:2.3:a:uvnc:ultravnc:*:*:*:*:*:*:*:*

History

09 Jul 2026, 06:16

Type	Values Removed	Values Added
References		() https://www.securin.io/zero-days/cve-2026-7831-off-by-one-stack-overflow-viewer-namelength-ultravnc -

02 Jul 2026, 15:22

Type	Values Removed	Values Added
First Time		Uvnc Uvnc ultravnc
References	~~() https://github.com/ultravnc/UltraVNC -~~	() https://github.com/ultravnc/UltraVNC - Product
References	~~() https://uvnc.com/ -~~	() https://uvnc.com/ - Product, Release Notes
CPE		cpe:2.3:a:uvnc:ultravnc::::::::

01 Jul 2026, 05:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-07-01 05:16

Updated : 2026-07-09 06:16

NVD link : CVE-2026-7831

Mitre link : CVE-2026-7831

CVE.ORG link : CVE-2026-7831

JSON object : View

Products Affected

uvnc

ultravnc

CWE

CWE-193

Off-by-one Error

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-7831", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7831", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-01T13:12:22.055256Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "affectedData": [{"vendor": "uvnc", "modules": ["vncviewer"], "product": "UltraVNC", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.8.2.2"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-01T05:16:24.380", "references": [{"url": "https://github.com/ultravnc/UltraVNC", "tags": ["Product"], "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c"}, {"url": "https://uvnc.com/", "tags": ["Product", "Release Notes"], "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c"}, {"url": "https://www.securin.io/zero-days/cve-2026-7831-off-by-one-stack-overflow-viewer-namelength-ultravnc", "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "description": [{"lang": "en", "value": "CWE-193"}, {"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message handler. In vncviewer/ClientConnection.cpp, when the server-supplied nameLength equals exactly 2024 the code declares a 2024-byte stack buffer _dn[2024] and calls ReadString(_dn, 2024). ReadString writes the NUL terminator at buf[length], i.e., _dn[2024], one byte past the end of the stack buffer. A malicious VNC server can trigger this condition by advertising a desktop name of length 2024 in its ServerInit message. On release builds without stack canaries the single-byte NUL overwrite adjacent stack data. On builds with /GS stack protection the canary is corrupted and the process terminates, resulting in denial of service. User interaction (connecting the viewer to the malicious server) is required."}], "lastModified": "2026-07-09T06:16:21.900", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:uvnc:ultravnc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "593F7EC1-0922-4652-817A-7D57A0F1210D", "versionEndIncluding": "1.8.2.2"}], "operator": "OR"}]}], "sourceIdentifier": "33c584b5-0579-4c06-b2a0-8d8329fcab9c"}