CVE-2026-44040 Details
Description
UltraVNC through 1.8.2.2 uses a cryptographically weak pseudo-random number generator to produce VNC authentication challenge bytes. In rfb/vncauth.c:119-129, the vncRandomBytes() function seeds libc rand() with time(0) + getpid() + rand() and generates a 16-byte challenge. The combined seed space is approximately 31 bits (libc rand() internal state) and is entirely determined by publicly-observable values (wall-clock time and process ID). An attacker who can observe the authentication exchange can enumerate the seed space and predict the challenge within seconds, enabling forgery or offline brute-forcing of responses. Note: on Windows, the active code path may use vncEncryptBytes2.cpp which calls CryptGenRandom; reachability on shipped Windows binaries requires compile-graph verification and is under investigation.
A vulnerability exists in UltraVNC versions through 1.8.2.2, where a weak pseudo-random number generator is used to create VNC authentication challenge bytes. The issue arises in the 'rfb/vncauth.c' file, specifically within the 'vncRandomBytes()' function. This function seeds the standard library's random number generator with a combination of the current time, process ID, and the generator's own output, resulting in a challenge that can be predicted by an attacker. The seed space is approximately 31 bits and based on publicly visible information. An attacker observing the authentication process can quickly predict the challenge, potentially allowing for authentication forgery or brute-force attacks on response verification.
Users are advised to update to UltraVNC version 1.8.2.4 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ultravnc/UltraVNC | securin | Product |
| https://uvnc.com/ | securin | ProductRelease Notes |
| https://www.securin.io/zero-days/cve-2026-44040-libc-rand-weak-rng-vnc-auth-challenge-ultravnc | securin |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | securin |
Affected Products
| Product | Versions |
|---|---|
| uvnc ultravnc | <= 1.8.2.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | CVE Modified | securin |
| Jul 2, 2026 | Initial Analysis | [email protected] |
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | New CVE Received | securin |