CVE-2026-7829 UltraVNC repeater authenticated out-of-bounds write in rule parser via oversized token
An authenticated administrator can trigger an out-of-bounds write in the rule parser to achieve code execution on the UltraVNC repeater host.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-7829?
CVE-2026-7829 is a high-severity memory corruption vulnerability in uvnc UltraVNC, published on 1 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In repeater/webgui/settings.c:225-272, after strncpy_s copies a rule token into temp1[rule1] (25-byte destination) or temp2/temp3 (16-byte destination), the code unconditionally writes a NUL terminator at temp1[rule1][len] = 0 without clamping len to the destination size. When an authenticated administrator saves a rule with a token length equal to or greater than the destination size, the NUL byte is written one or more bytes past the end of the stack-allocated array, corrupting adjacent stack data. An attacker who has obtained admin credentials (including via CVE-2026-7839 default password) can trigger this to gain code execution on the repeater host.
Weakness: CWE-787
Which versions are affected by CVE-2026-7829?
It affects 1 product.
Products include Uvnc Ultravnc.
How do I fix CVE-2026-7829?
No fix has been published for CVE-2026-7829 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-7829 being exploited?
There is no known exploitation of CVE-2026-7829 in the wild and no public exploit code.
Other vulnerabilities in uvnc UltraVNC
Sources
Also known as GHSA-fxj2-5q9g-wmp9.