CVE-2026-7838

UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap buffer overflow in the RFB protocol failure-response parsing path. In vncviewer/ClientConnection.cpp, the 4-byte network-supplied reasonLen field (type CARD32) is passed as reasonLen+1 to CheckBufferSize(). Because both operands are unsigned 32-bit, a reasonLen of 0xFFFFFFFF overflows to 0, causing CheckBufferSize to allocate only 256 bytes. The subsequent ReadString(m_netbuf, reasonLen) call then performs ReadExact for the original 4 GiB length into that 256-byte heap buffer. This overflow is reachable via rfbConnFailed (auth-scheme negotiation) and rfbVncAuthFailed (post-handshake) message types without successful authentication. A malicious VNC server, or any man-in-the-middle on the RFB stream, can trigger this condition when the victim viewer connects, potentially resulting in remote code execution as the user running the viewer. The crash was confirmed with AddressSanitizer on a portable reproduction harness (heap-buffer-overflow WRITE at offset 256).

• CWE-190
• CWE-787

• https://github.com/ultravnc/UltraVNCProduct
• https://uvnc.com/Product, Release Notes
• https://www.securin.io/zero-days/cve-2026-7838-heap-overflow-viewer-reasonlen-integer-overflow-ultravnc

Published

Jul 1, 2026

Last Modified

Jul 9, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7832A security flaw has been discovered in IObit Advanced System…7
• CVE-2026-7833A weakness has been identified in EFM ipTIME C200 up to 1.09…7.3
• CVE-2026-7834A security vulnerability has been detected in EFM ipTIME NAS…9.8
• CVE-2026-7835A format string argument mismatch in Netatalk 3.0.3 through …3.1
• CVE-2026-7836An incorrect calculation in the hextoint macro in Netatalk 2…3.1
• CVE-2026-7837A time-of-check time-of-use (TOCTOU) condition in the ad_flu…3.7
• CVE-2026-7839UltraVNC repeater through 1.8.2.2 initializes the HTTP admin…9.1
• CVE-2026-7840UltraVNC repeater through 1.8.2.2 contains a global buffer o…9.8
• CVE-2026-7841A remote code execution vulnerability exists in Notification…8.8
• CVE-2026-7842The Infility Global Infility Global WordPress plugin before …6.8
• CVE-2026-7844A vulnerability was detected in chatchat-space Langchain-Cha…6.3
• CVE-2026-7845A flaw has been found in chatchat-space Langchain-Chatchat u…2.6