Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-7829

UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In repeater/webgui/settings.c:225-272, after strncpy_s copies a rule token into temp1[rule1] (25-byte destination) or temp2/temp3 (16-byte destination), the code unconditionally writes a NUL terminator at temp1[rule1][len] = 0 without clamping len to the destination size. When an authenticated administrator saves a rule with a token length equal to or greater than the destination size, the NUL byte is written one or more bytes past the end of the stack-allocated array, corrupting adjacent stack data. An attacker who has obtained admin credentials (including via CVE-2026-7839 default password) can trigger this to gain code execution on the repeater host.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 39.4%
CVSS Severity
CVSS v3 Score 7.2
Products affected by CVE-2026-7829
  • Uvnc » Ultravnc » Version: 1.0.9.6.2
    cpe:2.3:a:uvnc:ultravnc:1.0.9.6.2
  • Uvnc » Ultravnc » Version: 1.1.8.9
    cpe:2.3:a:uvnc:ultravnc:1.1.8.9
  • Uvnc » Ultravnc » Version: 1.1.9.3
    cpe:2.3:a:uvnc:ultravnc:1.1.9.3
  • Uvnc » Ultravnc » Version: 1.1.9.6
    cpe:2.3:a:uvnc:ultravnc:1.1.9.6
  • Uvnc » Ultravnc » Version: 1.2.0.5
    cpe:2.3:a:uvnc:ultravnc:1.2.0.5
  • Uvnc » Ultravnc » Version: 1.2.0.9
    cpe:2.3:a:uvnc:ultravnc:1.2.0.9
  • Uvnc » Ultravnc » Version: 1.2.1.0
    cpe:2.3:a:uvnc:ultravnc:1.2.1.0
  • Uvnc » Ultravnc » Version: 1.2.1.2
    cpe:2.3:a:uvnc:ultravnc:1.2.1.2
  • Uvnc » Ultravnc » Version: 1.2.1.6
    cpe:2.3:a:uvnc:ultravnc:1.2.1.6
  • Uvnc » Ultravnc » Version: 1.2.1.7
    cpe:2.3:a:uvnc:ultravnc:1.2.1.7
  • Uvnc » Ultravnc » Version: 1.2.2.2
    cpe:2.3:a:uvnc:ultravnc:1.2.2.2
  • Uvnc » Ultravnc » Version: 1.2.2.3
    cpe:2.3:a:uvnc:ultravnc:1.2.2.3
  • Uvnc » Ultravnc » Version: 1.2.2.4
    cpe:2.3:a:uvnc:ultravnc:1.2.2.4
  • Uvnc » Ultravnc » Version: 1.2.4.0
    cpe:2.3:a:uvnc:ultravnc:1.2.4.0
  • Uvnc » Ultravnc » Version: 1.3.2
    cpe:2.3:a:uvnc:ultravnc:1.3.2
  • Uvnc » Ultravnc » Version: 1.3.4
    cpe:2.3:a:uvnc:ultravnc:1.3.4
  • Uvnc » Ultravnc » Version: 1.3.4.1
    cpe:2.3:a:uvnc:ultravnc:1.3.4.1
  • Uvnc » Ultravnc » Version: 1.3.4.2
    cpe:2.3:a:uvnc:ultravnc:1.3.4.2
  • Uvnc » Ultravnc » Version: 1.3.6.0
    cpe:2.3:a:uvnc:ultravnc:1.3.6.0
  • Uvnc » Ultravnc » Version: 1.3.8.0
    cpe:2.3:a:uvnc:ultravnc:1.3.8.0
  • Uvnc » Ultravnc » Version: 1.3.8.1
    cpe:2.3:a:uvnc:ultravnc:1.3.8.1
  • Uvnc » Ultravnc » Version: 1.4.0.5
    cpe:2.3:a:uvnc:ultravnc:1.4.0.5
  • Uvnc » Ultravnc » Version: 1.4.0.6
    cpe:2.3:a:uvnc:ultravnc:1.4.0.6
  • Uvnc » Ultravnc » Version: 1.4.0.9
    cpe:2.3:a:uvnc:ultravnc:1.4.0.9
  • Uvnc » Ultravnc » Version: 1.4.2.0
    cpe:2.3:a:uvnc:ultravnc:1.4.2.0
  • Uvnc » Ultravnc » Version: 1.4.3.0
    cpe:2.3:a:uvnc:ultravnc:1.4.3.0
  • Uvnc » Ultravnc » Version: 1.4.3.1
    cpe:2.3:a:uvnc:ultravnc:1.4.3.1
  • Uvnc » Ultravnc » Version: 1.4.3.5
    cpe:2.3:a:uvnc:ultravnc:1.4.3.5
  • Uvnc » Ultravnc » Version: 1.4.3.6
    cpe:2.3:a:uvnc:ultravnc:1.4.3.6
  • Uvnc » Ultravnc » Version: 1.5.0.0
    cpe:2.3:a:uvnc:ultravnc:1.5.0.0
  • Uvnc » Ultravnc » Version: 1.6.0.0
    cpe:2.3:a:uvnc:ultravnc:1.6.0.0
  • Uvnc » Ultravnc » Version: 1.6.1.0
    cpe:2.3:a:uvnc:ultravnc:1.6.1.0
  • Uvnc » Ultravnc » Version: 1.6.4.0
    cpe:2.3:a:uvnc:ultravnc:1.6.4.0
  • Uvnc » Ultravnc » Version: 1.8.2.2
    cpe:2.3:a:uvnc:ultravnc:1.8.2.2


Products
Pricing
Contact Us

Shodan ® - All rights reserved