CVE-2026-4962: UltraVNC Path Traversal Vulnerability

CVE-2026-4962 Overview

A security flaw has been discovered in UltraVNC up to version 1.6.4.0 involving an uncontrolled search path vulnerability in the version.dll library component of the Service. This vulnerability allows a local attacker to potentially hijack the DLL loading process, which could lead to arbitrary code execution with the privileges of the UltraVNC service. The attack requires local access and is characterized by high complexity, making exploitation difficult but not impossible for a skilled attacker.

Critical Impact

Local attackers with low privileges can potentially achieve code execution through DLL search path hijacking, compromising confidentiality, integrity, and availability of affected systems running UltraVNC Service.

Affected Products

• UltraVNC versions up to and including 1.6.4.0
• UltraVNC Service component utilizing version.dll

Discovery Timeline

• 2026-03-27 - CVE-2026-4962 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-4962

Vulnerability Analysis

This vulnerability is classified as CWE-426: Untrusted Search Path. The UltraVNC Service component improperly handles the loading of the version.dll library, failing to specify a secure search path for the DLL. When the service attempts to load version.dll, Windows follows its default DLL search order, which includes directories that may be writable by lower-privileged users.

An attacker with local access could place a malicious version.dll in a directory that precedes the legitimate DLL location in the search path. When the UltraVNC Service loads the DLL, the malicious version would be executed instead, potentially allowing the attacker to run arbitrary code with the privileges of the service.

The exploitation requires the attacker to have write access to a directory in the DLL search path and knowledge of when the service will be started or restarted. The vendor was contacted about this disclosure but did not respond.

Root Cause

The root cause of this vulnerability lies in the UltraVNC Service's failure to use secure DLL loading practices. Instead of specifying an absolute path when loading version.dll or using functions like SetDllDirectory() to restrict the search path, the application relies on the default Windows DLL search order. This allows an attacker to plant a malicious DLL in a location that will be searched before the legitimate DLL directory.

Attack Vector

The attack vector is local, requiring the attacker to have some level of access to the target system. The exploitation scenario involves:

1. The attacker identifies that UltraVNC Service is installed and uses version.dll
2. The attacker locates a writable directory in the DLL search path (such as the application's working directory or a directory in the system PATH)
3. The attacker places a malicious version.dll in this directory
4. When the UltraVNC Service is started or restarted, it loads the malicious DLL
5. The malicious code executes with the privileges of the UltraVNC Service

The attack complexity is high because the attacker must have local access and write permissions to an appropriate directory, and must understand the specific DLL loading behavior of the application.

Detection Methods for CVE-2026-4962

Indicators of Compromise

• Unexpected version.dll files present in non-standard directories, particularly the UltraVNC working directory or writable PATH directories
• Modified timestamps on version.dll that don't match other UltraVNC installation files
• Process creation events showing UltraVNC Service loading DLLs from unexpected locations
• Suspicious processes spawned as children of the UltraVNC Service process

Detection Strategies

• Monitor for DLL loading events from the UltraVNC Service process, particularly for version.dll loads from non-standard paths
• Implement file integrity monitoring on UltraVNC installation directories to detect unauthorized file additions
• Use endpoint detection tools to alert on DLL side-loading or DLL hijacking patterns
• Deploy application whitelisting to prevent execution of unauthorized DLLs

Monitoring Recommendations

• Enable Windows Sysmon logging with configuration to capture DLL load events (Event ID 7)
• Configure security monitoring to alert on file creation in directories within the system PATH
• Implement behavioral analytics to detect anomalous process relationships involving UltraVNC Service
• Review service startup logs for any indication of DLL loading failures or unexpected behavior

How to Mitigate CVE-2026-4962

Immediate Actions Required

• Audit systems for unauthorized version.dll files in the UltraVNC directory and PATH directories
• Restrict write permissions on directories in the DLL search path to administrators only
• Consider temporarily disabling UltraVNC Service on critical systems until a patch is available
• Implement application control policies to prevent execution of unsigned DLLs

Patch Information

At the time of publication, no official patch has been released by the vendor. The vendor was contacted early about this disclosure but did not respond. Organizations should monitor the VulDB entry for updates on patch availability. Additional technical details are available through the VulDB CTI entry.

Workarounds

• Use application control solutions (such as Windows Defender Application Control or AppLocker) to block execution of unsigned or untrusted DLLs
• Ensure all directories in the system PATH environment variable have restricted write permissions (administrators only)
• Run UltraVNC Service with the minimum required privileges
• Consider using an alternative remote desktop solution until the vendor addresses this vulnerability
• Implement network segmentation to limit exposure of systems running vulnerable UltraVNC versions

# Restrict permissions on UltraVNC directory (run as Administrator)
icacls "C:\Program Files\uvnc bvba\UltraVNC" /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" /grant:r "Administrators:(OI)(CI)F" /grant:r "Users:(OI)(CI)RX"

# Review DLLs in UltraVNC directory
dir "C:\Program Files\uvnc bvba\UltraVNC\*.dll" /s

# Check for version.dll in common hijack locations
dir "%USERPROFILE%\version.dll" 2>nul
dir "%TEMP%\version.dll" 2>nul