CVE-2026-7840: UltraVNC Repeater Buffer Overflow

What Happened and Why This Matters

CVE-2026-7840 is a critical global buffer overflow in UltraVNC Repeater through version 1.8.2.2. According to the NVD description, the flaw sits in the product’s embedded HTTP administration server and affects the functions wi_senderr() and wi_replyhdr() in repeater/webgui/webutils.c. Those functions reportedly copy a caller-controlled HTTP request URI into a fixed 1000-byte global buffer named hdrbuf using unchecked sprintf calls.

From a defender’s perspective, this is not a marginal bug. The NVD description says the HTTP receive buffer can accept URIs up to roughly 150 KB (WI_RXBUFSIZE = 153600), and an attacker can trigger the overflow with a URI of around 1500 bytes or more. That means the vulnerable path is exposed before authentication and can be reached by any remote party that can connect to the HTTP administration interface, typically TCP port 80. The stated impact is remote arbitrary code execution on the repeater host.

Affected Products and Version Range

The affected product identified in the available sources is UltraVNC Repeater. The version range currently supported by the NVD description is “through 1.8.2.2”, which means defenders should treat all versions up to and including 1.8.2.2 as vulnerable unless they have stronger vendor evidence showing otherwise.

A crucial limitation is that the provided source set does not confirm a fixed release number. The NVD references in the research note point to the UltraVNC GitHub repository and the official vendor site, but the supplied findings do not show an advisory, release note, or commit mapping this CVE to a specific patched version. In practice, that means your asset inventory should tag 1.8.2.2 and earlier as exposed, and anything newer should be considered unverified rather than automatically safe until the vendor publishes a definitive fix statement.

Exploitation Status and Defender Assumptions

At the time of writing, exploitation in the wild is not confirmed from the provided data. The CVE is not listed in CISA’s Known Exploited Vulnerabilities catalog, which means there is no CISA-backed confirmation of active exploitation at this time. That is useful context, but it should not be read as a sign the issue is low-risk.

Also, no public PoC is confirmed from the available sources in this research set. However, defenders should not over-index on the absence of a PoC. The NVD description already provides unusually actionable technical details: vulnerable function names, source path, a fixed-size target buffer, a rough trigger length, and the note that exploitation is reachable before authentication over the HTTP admin interface. For an experienced attacker or researcher, that is often enough to reproduce the bug quickly.

Risk Assessment for Real Environments

The most important operational question is whether your UltraVNC Repeater HTTP administration service is reachable by untrusted networks. If it is exposed to the internet, partner networks, branch segments, or user VLANs, you should treat this as a potential unauthenticated remote code execution path with critical urgency. Even if the vulnerable service is only on an internal network, many organizations have broad east-west reachability that makes internal exposure meaningful.

The second risk factor is host placement. UltraVNC Repeater instances often sit in positions that support remote administration workflows, which can make them attractive pivot points. A successful compromise of the repeater host could expose credentials, provide lateral movement opportunities, or interfere with remote support operations. Because the available data does not confirm a fixed version, the safest assumption is that network controls and service exposure reduction are your immediate defenses.

Technical Deep Dive

The underlying bug is described as a global buffer overflow involving a fixed 1000-byte global buffer, hdrbuf, in the embedded web GUI code. The reported vulnerable functions, wi_senderr() and wi_replyhdr(), use unchecked sprintf calls to place an attacker-controlled URI into that buffer. This is a classic memory safety failure: unbounded copy into fixed storage with attacker-controlled input length.

Two details make this especially serious. First, the overflow occurs in processing of the HTTP request URI, which is available before authentication. Second, the receive buffer size is said to allow much larger input than the target buffer can safely hold. NVD notes URIs up to about 150 KB may be accepted, while the fixed destination buffer is only 1000 bytes. That gap creates an obvious overflow condition and reportedly allows corruption of adjacent global variables in the .bss segment, with the stated consequence of remote arbitrary code execution.

Technical Notes

The functions and file path called out in the NVD description are:

// Reported vulnerable locations from NVD description
wi_senderr()
wi_replyhdr()

// File path
repeater/webgui/webutils.c

The core unsafe pattern is described as unchecked formatting into a fixed-size buffer:

// Simplified conceptual example based on the NVD description
char hdrbuf[1000];
sprintf(hdrbuf, "HTTP/1.1 404 Not Found\r\nLocation: %s\r\n\r\n", request_uri);

In a safe implementation, a bounded function and explicit length handling would be expected instead:

// Safer conceptual approach
_snprintf(hdrbuf, sizeof(hdrbuf),
          "HTTP/1.1 404 Not Found\r\nLocation: %s\r\n\r\n",
          request_uri_truncated);
hdrbuf[sizeof(hdrbuf) - 1] = '\0';

This example is illustrative, not a claim about the exact vendor patch. The important point for defenders is that the vulnerable condition is tied to oversized URIs hitting the embedded HTTP service.

What Defenders Should Do Next

Start with asset discovery. Identify every host running UltraVNC Repeater, then determine whether the embedded HTTP administration interface is reachable from anything beyond a dedicated management segment. If you cannot quickly verify exposure, assume it may be reachable and put temporary controls in place. That means firewall restriction first, exposure reduction second, and deeper log review in parallel.

Then establish a watchlist for vendor updates. Because the fixed version is not confirmed from the provided references, your patch management team should not close this item based on assumption. Require explicit evidence such as a release note, commit reference, changelog entry, or vendor advisory naming CVE-2026-7840 and stating the first non-vulnerable version. Until that exists, your defensive posture should treat all versions through 1.8.2.2 as vulnerable and any newer version as unverified.

For more information on related security concepts, you can read about microsegmentation and check our FAQ on LLM output security auditing.