CVE-2026-7840 UltraVNC repeater HTTP server global buffer overflow via long URI (pre-auth RCE)

Critical 9.3 Published 1 Jul 2026 Updated 9 Jul 2026

Unauthenticated remote attackers can achieve arbitrary code execution on UltraVNC repeater servers via a buffer overflow in the embedded HTTP administration server.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-7840?

CVE-2026-7840 is a critical memory corruption vulnerability in uvnc UltraVNC, published on 1 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embedded HTTP administration server. The functions wi_senderr() and wi_replyhdr() in repeater/webgui/webutils.c write the caller-supplied HTTP request URI into a fixed 1000-byte global buffer (hdrbuf) via unchecked sprintf calls. The HTTP receive buffer accepts URIs up to approximately 150 KB (WI_RXBUFSIZE = 153600), so an unauthenticated attacker who can reach the repeater HTTP port (default TCP 80) can overflow hdrbuf by at least 500 bytes with a single HTTP request containing a URI of 1500 bytes or longer, corrupting adjacent .bss-segment globals. The overflow occurs before any authentication check, making it reachable without credentials. A remote, unauthenticated attacker can achieve arbitrary code execution on the host running the repeater.

Weakness: CWE-787

Which versions are affected by CVE-2026-7840?

It affects 1 product.

Products include Uvnc Ultravnc.

How do I fix CVE-2026-7840?

No fix has been published for CVE-2026-7840 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-7840 being exploited?

There is no known exploitation of CVE-2026-7840 in the wild and no public exploit code.

Sources

Also known as GHSA-95qw-xpp9-h343.