What this actually is.
Technical background, root cause, and affected surface.
UltraVNC repeater through 1.8.2.2 contains an off-by-one error in the Base64 decode helper used for HTTP Basic authentication. In repeater/webgui/webutils.c:817, the wi_uudecode() function checks whether the input length exceeds the output buffer with a strict greater-than comparison (>), while the correct check should be greater-than-or-equal (>=). When strlen(authdata) equals sizeof(decode), the decoded output length (approximately 3/4 of input) does not overflow the buffer in current practice because the outer HTTP request bounds constrain the Authorization header. However, the defective check leaves a latent off-by-one condition that could become exploitable if the buffering constraints change. The current risk is limited to a one-byte write at the boundary of a 1024-byte stack buffer under constrained conditions.
- Vendor
- UltraVNC
- Product
- UltraVNC Repeater
- Severity
- Low
- CVSS Score
- 3.7
- Status
- Fixed
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
- CWE
- CWE-193: Off-by-one Error
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The bug, and the fix.
// webutils.c:846 if (strlen(authdata) > sizeof(decode)) goto failed; // should be >= // At exact boundary: decoded NUL written at decode[1024] — 1 byte OOB
Root cause: Strict > comparison instead of >= in buffer overflow guard. decode() function lacks explicit output buffer size parameter.
When does this fire?
All conditions must be true for the exploit to succeed.
Would require strlen(authdata) exactly equal to sizeof(decode)=1024 bytes in the Authorization header. Under normal HTTP Basic auth usage this does not occur.
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Latent off-by-one. No current exploitable path. At the exact 1024-byte boundary, NUL could write 1 byte past the decode buffer onto the stack.
C:N · I:N · A:L
CWE-193: Off-by-one Error
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Change > to >= in the caller check. Add outbufsize parameter to wi_uudecode. Vendor fix applied: outbufsize parameter added; >= guard applied.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Discovered during audit
Reported to vendor
Fix validated
Planned public disclosure
Timeline recorded · Disclosure coordinated by Securin
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.