{"id":"CVE-2026-7831","state":"PUBLISHED","title":"UltraVNC viewer off-by-one stack overflow in ServerInit desktop name parsing","description":"UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message handler. In vncviewer/ClientConnection.cpp, when the server-supplied nameLength equals exactly 2024 the code declares a 2024-byte stack buffer _dn[2024] and calls ReadString(_dn, 2024). ReadString writes the NUL terminator at buf[length], i.e., _dn[2024], one byte past the end of the stack buffer. A malicious VNC server can trigger this condition by advertising a desktop name of length 2024 in its ServerInit message. On release builds without stack canaries the single-byte NUL overwrite adjacent stack data. On builds with /GS stack protection the canary is corrupted and the process terminates, resulting in denial of service. User interaction (connecting the viewer to the malicious server) is required.","publishedAt":"2026-07-01T03:33:25.314Z","updatedAt":"2026-07-09T04:35:54.891Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","source":"securin"},"assigner":"securin","products":["uvnc UltraVNC"],"affected":[{"vendor":"uvnc","product":"UltraVNC","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.8.2.2","versionType":"custom"}],"modules":["vncviewer"]}],"references":["https://uvnc.com/","https://github.com/ultravnc/UltraVNC","https://www.securin.io/zero-days/cve-2026-7831-off-by-one-stack-overflow-viewer-namelength-ultravnc"],"weaknesses":["CWE-193","CWE-787"],"ingestedAt":"2026-10-29T20:13:07.220Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/7xxx/CVE-2026-7831.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-7831","state":"PUBLISHED","datePublished":"2026-07-01T03:33:25.314Z","dateUpdated":"2026-07-09T04:35:54.891Z","assignerShortName":"securin","assignerOrgId":"33c584b5-0579-4c06-b2a0-8d8329fcab9c","dateReserved":"2026-05-05T04:03:22.622Z"},"containers":{"cna":{"title":"UltraVNC viewer off-by-one stack overflow in ServerInit desktop name parsing","descriptions":[{"lang":"en","value":"UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message handler. In vncviewer/ClientConnection.cpp, when the server-supplied nameLength equals exactly 2024 the code declares a 2024-byte stack buffer _dn[2024] and calls ReadString(_dn, 2024). ReadString writes the NUL terminator at buf[length], i.e., _dn[2024], one byte past the end of the stack buffer. A malicious VNC server can trigger this condition by advertising a desktop name of length 2024 in its ServerInit message. On release builds without stack canaries the single-byte NUL overwrite adjacent stack data. On builds with /GS stack protection the canary is corrupted and the process terminates, resulting in denial of service. User interaction (connecting the viewer to the malicious server) is required."}],"affected":[{"vendor":"uvnc","product":"UltraVNC","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.8.2.2","versionType":"custom"}],"modules":["vncviewer"]}],"references":[{"url":"https://uvnc.com/","name":"UltraVNC project page","tags":["vendor-advisory"]},{"url":"https://github.com/ultravnc/UltraVNC","name":"UltraVNC source repository","tags":["product"]},{"url":"https://www.securin.io/zero-days/cve-2026-7831-off-by-one-stack-overflow-viewer-namelength-ultravnc"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-193","type":"CWE","lang":"en","description":"Off-by-one Error"}]},{"descriptions":[{"cweId":"CWE-787","type":"CWE","lang":"en","description":"Out-of-bounds Write"}]}],"providerMetadata":{"shortName":"securin","orgId":"33c584b5-0579-4c06-b2a0-8d8329fcab9c","dateUpdated":"2026-07-09T04:35:54.891Z"},"timeline":[{"time":"2026-06-02T00:00:00.000Z","lang":"en","value":"Vulnerability discovered during security audit"},{"time":"2026-06-17T00:00:00.000Z","lang":"en","value":"Reported to vendor (coordinated disclosure)"},{"time":"2026-09-15T00:00:00.000Z","lang":"en","value":"Planned public disclosure (90-day window)"}],"credits":[{"lang":"en","value":"Arjun Basnet, Securin (arjun.basnet@securin.io)","type":"finder"}],"source":{"discovery":"EXTERNAL","advisory":"Securin Security Advisory — FINDING-011"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-01T13:12:22.055256Z","id":"CVE-2026-7831","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-01T13:12:46.218Z"}}]}}}