CVE-2026-7829— UltraVNC repeater authenticated out-of-bounds write in rule parser via oversized token

UltraVNC repeater authenticated out-of-bounds write in rule parser via oversized token

UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In repeater/webgui/settings.c:225-272, after strncpy_s copies a rule token into temp1[rule1] (25-byte destination) or temp2/temp3 (16-byte destination), the code unconditionally writes a NUL terminator at temp1[rule1][len] = 0 without clamping len to the destination size. When an authenticated administrator saves a rule with a token length equal to or greater than the destination size, the NUL byte is written one or more bytes past the end of the stack-allocated array, corrupting adjacent stack data. An attacker who has obtained admin credentials (including via CVE-2026-7839 default password) can trigger this to gain code execution on the repeater host.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

跨界内存写

UltraVNC 缓冲区错误漏洞

ultravnc是UltraVNC组织开源的一款用于Windows平台的开源远程终端控制软件。 UltraVNC 1.8.2.2及之前版本存在缓冲区错误漏洞，该漏洞源于允许/拒绝规则解析器中的越界写入问题，在strncpy_s复制规则令牌后未限制长度，导致NUL终止符写入超出栈分配数组边界，破坏相邻栈数据，可能允许已获管理员凭据的攻击者在中继主机上执行代码。

N/A

N/A