What this actually is.
Technical background, root cause, and affected surface.
UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In repeater/webgui/settings.c:225-272, after strncpy_s copies a rule token into temp1[rule1] (25-byte destination) or temp2/temp3 (16-byte destination), the code unconditionally writes a NUL terminator at temp1[rule1][len] = 0 without clamping len to the destination size. When an authenticated administrator saves a rule with a token length equal to or greater than the destination size, the NUL byte is written one or more bytes past the end of the stack-allocated array, corrupting adjacent stack data. An attacker who has obtained admin credentials (including via CVE-2026-7839 default password) can trigger this to gain code execution on the repeater host.
- Vendor
- UltraVNC
- Product
- UltraVNC Repeater
- Severity
- High
- CVSS Score
- 7.2
- Status
- Fixed
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-787: Out-of-bounds Write
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
No standalone exploit. Chain with CVE-2026-7839 (admin:adminadmi2): POST admin rule via HTTP UI with 25-byte token → NUL written at stack offset 25 → stack corruption.
The bug, and the fix.
strncpy_s(temp1[rule1], 25, pos, len); // settings.c:232 — truncates at 24 temp1[rule1][len] = 0; // OOB NUL when len >= 25 // Same pattern at lines 248, 264 (destSize=16)
Root cause: Direct array index write temp1[rule1][len]=0 not guarded by destination size (25). strncpy_s prevents buffer overread but does not prevent the unconditional subsequent write. Pattern repeated at three call sites.
When does this fire?
All conditions must be true for the exploit to succeed.
Attacker authenticates to HTTP admin (default credentials CVE-2026-7839 or compromised account). 2. Submits allow/deny rule via web UI with a token ≥25 characters. 3. Parser calls strncpy_s then writes token[len]=0 at out-of-bounds stack location.
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Stack corruption via single NUL byte write past array boundary. When chained with default password (CVE-2026-7839), yields post-auth code execution on the repeater host.
C:H · I:H · A:H
CWE-787: Out-of-bounds Write
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Clamp len to destSize-1 before the NUL write. Vendor fix: if (len >= 25) len = 24; added before each NUL-write site; same for 16-byte destinations.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Discovered during audit
Reported to vendor
Fix validated
Planned public disclosure
Timeline recorded · Disclosure coordinated by Securin
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.