CVE-2026-44042

UltraVNC repeater through 1.8.2.2 contains an off-by-one error in the Base64 decode helper used for HTTP Basic authentication. In repeater/webgui/webutils.c:817, the wi_uudecode() function checks whether the input length exceeds the output buffer with a strict greater-than comparison (>), while the correct check should be greater-than-or-equal (>=). When strlen(authdata) equals sizeof(decode), the decoded output length (approximately 3/4 of input) does not overflow the buffer in current practice because the outer HTTP request bounds constrain the Authorization header. However, the defective check leaves a latent off-by-one condition that could become exploitable if the buffering constraints change. The current risk is limited to a one-byte write at the boundary of a 1024-byte stack buffer under constrained conditions.

• CWE-193

• https://github.com/ultravnc/UltraVNCProduct
• https://uvnc.com/Product, Release Notes
• https://www.securin.io/zero-days/cve-2026-44042-wi-uudecode-off-by-one-bounded-ultravnc-repeater

Published

Jul 1, 2026

Last Modified

Jul 9, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44025Fluentd collects events from various data sources and writes…7.5
• CVE-2026-44028An issue was discovered in Nix before 2.34.7 and Lix before …7.5
• CVE-2026-44029An issue was discovered in Nix before 2.34.7. Writing to arb…5.3
• CVE-2026-4404Use of hard coded credentials in GoHarbor Harbor version 2.1…9.4
• CVE-2026-44040UltraVNC through 1.8.2.2 uses a cryptographically weak pseud…6.5
• CVE-2026-44041UltraVNC through 1.8.2.2 contains an out-of-bounds read in t…6.5
• CVE-2026-44046Use of Less Trusted Source vulnerability in Apache APISIX. …5.8
• CVE-2026-44047An SQL injection vulnerability in the MySQL CNID backend in …8.8
• CVE-2026-44048A stack-based buffer overflow via UCS-2 type confusion in co…8.8
• CVE-2026-44049An out-of-bounds write due to improper null termination in c…7.5
• CVE-2026-44050A heap-based buffer overflow in the CNID daemon comm_rcv() f…9.9
• CVE-2026-44051An improper link resolution vulnerability in Netatalk 3.0.2 …8.1