CVE-2026-7829

UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In repeater/webgui/settings.c:225-272, after strncpy_s copies a rule token into temp1[rule1] (25-byte destination) or temp2/temp3 (16-byte destination), the code unconditionally writes a NUL terminator at temp1[rule1][len] = 0 without clamping len to the destination size. When an authenticated administrator saves a rule with a token length equal to or greater than the destination size, the NUL byte is written one or more bytes past the end of the stack-allocated array, corrupting adjacent stack data. An attacker who has obtained admin credentials (including via CVE-2026-7839 default password) can trigger this to gain code execution on the repeater host.

• CWE-787

• https://github.com/ultravnc/UltraVNCProduct
• https://uvnc.com/Product, Release Notes
• https://www.securin.io/zero-days/cve-2026-7829-post-auth-oob-nul-write-repeater-rule-parser-ultravnc

Published

Jul 1, 2026

Last Modified

Jul 9, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7820Improper restriction of excessive authentication attempts (C…6.9
• CVE-2026-7821Improper certificate validation in Ivanti EPMM before versio…9.1
• CVE-2026-7822A vulnerability was identified in itsourcecode Courier Manag…6.3
• CVE-2026-7823A security flaw has been discovered in Totolink A8000RU 7.1c…9.8
• CVE-2026-7824An issue was discovered in the PaperCut Hive Ricoh embedded …5.9
• CVE-2026-7828UltraVNC repeater through 1.8.2.2 contains an integer overfl…5.3
• CVE-2026-7830UltraVNC through 1.8.2.2 uses inadequate cryptography in the…7.4
• CVE-2026-7831UltraVNC viewer through 1.8.2.2 contains an off-by-one stack…7.6
• CVE-2026-7832A security flaw has been discovered in IObit Advanced System…7
• CVE-2026-7833A weakness has been identified in EFM ipTIME C200 up to 1.09…7.3
• CVE-2026-7834A security vulnerability has been detected in EFM ipTIME NAS…9.8
• CVE-2026-7835A format string argument mismatch in Netatalk 3.0.3 through …3.1