CVE-2026-7840 Details

A global buffer overflow vulnerability has been identified in the UltraVNC repeater, in versions through 1.8.2.2. The issue resides in the embedded HTTP administration server, specifically within the functions wi_senderr() and wi_replyhdr() in the file webutils.c. These functions write the caller-supplied HTTP request URI into a fixed 1000-byte global buffer using unchecked sprintf calls. The HTTP receive buffer can accept URIs up to approximately 150 KB, allowing an unauthenticated attacker who can access the repeater HTTP port (default TCP 80) to overflow the global buffer by at least 500 bytes with a single HTTP request containing a URI of 1500 bytes or longer. This overflow corrupts adjacent .bss-segment globals and occurs before any authentication check, making it reachable without credentials. As a result, a remote, unauthenticated attacker can execute arbitrary code on the host running the repeater.