CVE-2026-7840: UltraVNC Repeater RCE Vulnerability

CVE-2026-7840 Overview

CVE-2026-7840 is a global buffer overflow vulnerability in the UltraVNC repeater component through version 1.8.2.2. The flaw resides in the embedded HTTP administration server, where the wi_senderr() and wi_replyhdr() functions in repeater/webgui/webutils.c write attacker-controlled HTTP request URIs into a fixed 1000-byte global buffer named hdrbuf using unchecked sprintf calls. The HTTP receive buffer accepts URIs up to approximately 150 KB, allowing an unauthenticated remote attacker to overflow hdrbuf and corrupt adjacent .bss segment globals. Successful exploitation leads to arbitrary code execution on the host running the repeater.

Critical Impact
A remote, unauthenticated attacker who can reach the repeater HTTP port (default TCP 80) can achieve arbitrary code execution by sending a single HTTP request with a URI of 1500 bytes or longer.

Affected Products

UltraVNC repeater versions through 1.8.2.2
Deployments exposing the repeater HTTP administration interface on TCP 80
Systems using the embedded web GUI in repeater/webgui/webutils.c

Discovery Timeline

2026-07-01 - CVE-2026-7840 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-7840

Vulnerability Analysis

The vulnerability is a classic out-of-bounds write [CWE-787] triggered by an unchecked sprintf call in the UltraVNC repeater HTTP administration server. Two functions handle response header formatting: wi_senderr() and wi_replyhdr(). Both functions embed the caller-supplied HTTP request URI into a response header string written to a fixed-size global buffer.

The destination buffer hdrbuf is declared as a 1000-byte global in the .bss segment. The HTTP receive buffer WI_RXBUFSIZE is defined as 153600 bytes, so incoming URIs can be up to approximately 150 KB. This size mismatch enables overflow by a factor of over 150x.

Because the overflow occurs before any authentication check runs, no credentials are required. Corruption of adjacent .bss globals gives an attacker control over function pointers, state variables, and other data used by the repeater process.

Root Cause

The root cause is the use of sprintf without bounds checking when writing user-controlled data into a fixed-size global buffer. Neither wi_senderr() nor wi_replyhdr() validates the length of the URI before formatting it into hdrbuf. The correct pattern would be snprintf with an explicit destination size, or an upfront length check against the incoming URI.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a single crafted HTTP request to the repeater's HTTP port with a URI of at least 1500 bytes. This overflows hdrbuf by at least 500 bytes and corrupts adjacent .bss globals, enabling arbitrary code execution in the repeater process context.

The vulnerability is described in prose only. See the GitHub UltraVNC Repository for source code and the UVNC Official Website for vendor information.

Detection Methods for CVE-2026-7840

Indicators of Compromise

Inbound HTTP requests to the repeater administration port (default TCP 80) containing URIs longer than 1000 bytes
Unexpected process crashes or restarts of the UltraVNC repeater service
Outbound network connections initiated by the repeater process to attacker-controlled infrastructure

Detection Strategies

Inspect HTTP request logs and packet captures for oversized URIs targeting the repeater HTTP interface
Monitor the repeater process for abnormal memory access patterns, segmentation faults, and unexpected child process creation
Alert on any HTTP requests to the repeater management port originating from untrusted network segments

Monitoring Recommendations

Enable verbose HTTP request logging on the repeater to capture full URI strings for retrospective analysis
Deploy network detection rules that flag HTTP requests with URI lengths exceeding 1000 bytes to repeater endpoints
Track process integrity and command-line telemetry for the repeater binary and any spawned processes

How to Mitigate CVE-2026-7840

Immediate Actions Required

Restrict network access to the repeater HTTP administration port (default TCP 80) using host and network firewalls, limiting reachability to trusted management sources only
Disable the embedded HTTP administration server if it is not required for operations
Isolate the repeater host in a segmented network to reduce exposure of the vulnerable service

Patch Information

At the time of publication, no fixed release is referenced in the NVD entry. Monitor the GitHub UltraVNC Repository and the UVNC Official Website for updates addressing the sprintf usage in wi_senderr() and wi_replyhdr().

Workarounds

Block TCP 80 (or the configured HTTP admin port) at the perimeter and internal firewalls for the repeater host
Place the repeater behind a reverse proxy or web application firewall that enforces a strict maximum URI length below 1000 bytes
Terminate the HTTP administration server process if the web GUI is not actively used, leaving only the VNC repeater relay functions operational

bash

# Example firewall rule to restrict access to the repeater HTTP admin port
iptables -A INPUT -p tcp --dport 80 -s <trusted_management_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP