CVE-2026-7829: UltraVNC Repeater RCE Vulnerability

CVE-2026-7829 Overview

CVE-2026-7829 is a post-authentication out-of-bounds write vulnerability in the UltraVNC repeater component through version 1.8.2.2. The flaw resides in the allow/deny rule parser located in repeater/webgui/settings.c at lines 225-272. After strncpy_s copies a rule token into fixed-size stack buffers, the parser unconditionally writes a NUL terminator at an attacker-controlled offset without clamping the length to the destination size. An authenticated administrator can save a crafted rule to corrupt adjacent stack data and achieve code execution on the repeater host.

Critical Impact
Authenticated attackers with administrative credentials can trigger stack memory corruption to execute arbitrary code on the UltraVNC repeater host, particularly when chained with the default password issue tracked as CVE-2026-7839.

Affected Products

UltraVNC repeater through version 1.8.2.2
UltraVNC deployments exposing the web GUI settings interface
UltraVNC installations retaining default administrator credentials

Discovery Timeline

2026-07-01 - CVE-2026-7829 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-7829

Vulnerability Analysis

The vulnerability is a stack-based out-of-bounds write classified under [CWE-787]. The UltraVNC repeater processes allow/deny rules through its web GUI settings handler. The parser uses strncpy_s to copy rule tokens into three destination arrays: temp1[rule1] with a 25-byte capacity, and temp2 and temp3 with 16-byte capacities. While strncpy_s limits the copy, the subsequent statement temp1[rule1][len] = 0 writes a NUL terminator at the original token length without validating that len remains within the destination bounds.

When an authenticated administrator submits a rule whose token length equals or exceeds the destination capacity, the NUL byte lands one or more bytes past the end of the stack buffer. This corrupts adjacent stack variables, saved frame pointers, or return addresses depending on compiler layout and hardening. An attacker can shape rule input to overwrite control data and redirect execution.

Root Cause

The root cause is a missing bounds check on the length used for NUL termination. The code trusts the pre-copy token length rather than the truncated length returned by the safe copy routine. This defeats the protection normally provided by strncpy_s and reintroduces classic stack corruption behavior into an otherwise hardened API call.

Attack Vector

Exploitation requires administrative authentication to the repeater web GUI. When the repeater retains default credentials (tracked as CVE-2026-7839), an unauthenticated network attacker can obtain admin access first, then submit a malicious allow/deny rule to trigger the write. The out-of-bounds NUL byte is written on the stack, giving attackers a primitive suitable for control-flow hijack on builds without full stack protector coverage. See the GitHub UltraVNC Repository for source context.

Detection Methods for CVE-2026-7829

Indicators of Compromise

Unexpected UltraVNC repeater process crashes or restarts following administrator logins to the web GUI
Web GUI POST requests to the settings endpoint containing oversized allow/deny rule tokens exceeding 25 bytes
New or unusual child processes spawned by the repeater service account
Authentication events for the repeater admin account originating from unexpected source addresses

Detection Strategies

Inspect HTTP request bodies to the repeater web GUI for allow/deny rule fields exceeding the documented token sizes
Monitor the repeater process for stack canary violations, access violations, or abnormal exits captured in Windows Event Log
Correlate administrative authentication events with subsequent process creation on the repeater host

Monitoring Recommendations

Enable verbose logging on the UltraVNC repeater and forward events to a centralized log platform
Track configuration file changes to repeater rule storage for unexpected modifications
Alert on any process launched by the repeater binary that is not part of its documented behavior

How to Mitigate CVE-2026-7829

Immediate Actions Required

Change all default and administrator credentials on UltraVNC repeater instances to defeat the CVE-2026-7839 chain
Restrict network access to the repeater web GUI to trusted management subnets only
Audit existing allow/deny rules for oversized or suspicious tokens and remove any that were not authorized
Upgrade to a fixed version once the maintainers publish a release beyond 1.8.2.2

Patch Information

No vendor advisory URL is listed in the NVD entry at this time. Monitor the UltraVNC Official Website and the GitHub UltraVNC Repository for a patched build that clamps the NUL terminator index to the destination buffer size in repeater/webgui/settings.c.

Workarounds

Place the repeater web GUI behind a reverse proxy that enforces authentication and input length limits on rule fields
Disable remote access to the web GUI and manage rules only from a local administrative session
Apply host-based firewall rules to block inbound access to the repeater management port from untrusted networks

bash

# Configuration example: restrict repeater management access with Windows Firewall
netsh advfirewall firewall add rule name="UltraVNC Repeater WebGUI - Restrict" \
  dir=in action=block protocol=TCP localport=5912
netsh advfirewall firewall add rule name="UltraVNC Repeater WebGUI - Allow Mgmt" \
  dir=in action=allow protocol=TCP localport=5912 remoteip=10.0.0.0/24