CVE-2026-7828

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7828", "assignerOrgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "state": "PUBLISHED", "assignerShortName": "securin", "dateReserved": "2026-05-05T03:40:50.298Z", "datePublished": "2026-07-01T03:33:21.648Z", "dateUpdated": "2026-07-09T04:36:02.166Z"}, "containers": {"cna": {"title": "UltraVNC repeater integer overflow in win_log malloc leading to heap overflow", "descriptions": [{"lang": "en", "value": "UltraVNC repeater through 1.8.2.2 contains an integer overflow in the HTTP request logging path. In repeater/webgui/settings.c:336, the win_log() function allocates list nodes via malloc(sizeof(struct LIST) + strlen(line)), where line is derived from HTTP request URIs. If strlen(line) is sufficiently large, the addition overflows to a value smaller than sizeof(struct LIST), causing a heap allocation smaller than required. The subsequent strcpy of the full string into the undersized allocation produces a heap buffer overflow. In the current implementation this overflow is bounded by the HTTP receive buffer size (WI_RXBUFSIZE = 153600 bytes, well below SIZE_MAX on 32-bit builds), limiting practical exploitability to a partial heap write. A remote unauthenticated attacker can trigger the theoretical overflow path by sending a maximally-sized URI in an HTTP request to the repeater HTTP port."}], "affected": [{"vendor": "uvnc", "product": "UltraVNC", "versions": [{"version": "0", "lessThanOrEqual": "1.8.2.2", "status": "affected", "versionType": "custom"}], "defaultStatus": "unaffected", "modules": ["repeater"]}], "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-190", "lang": "en", "description": "Integer Overflow or Wraparound"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://uvnc.com/", "name": "UltraVNC project page", "tags": ["vendor-advisory"]}, {"url": "https://github.com/ultravnc/UltraVNC", "name": "UltraVNC source repository", "tags": ["product"]}, {"url": "https://www.securin.io/zero-days/cve-2026-7828-integer-overflow-win-log-malloc-ultravnc-repeater"}], "timeline": [{"time": "2026-06-02T00:00:00.000Z", "lang": "en", "value": "Vulnerability discovered during security audit"}, {"time": "2026-06-17T00:00:00.000Z", "lang": "en", "value": "Reported to vendor (coordinated disclosure)"}, {"time": "2026-09-15T00:00:00.000Z", "lang": "en", "value": "Planned public disclosure (90-day window)"}], "credits": [{"lang": "en", "value": "Arjun Basnet, Securin (arjun.basnet@securin.io)", "type": "finder"}], "source": {"discovery": "EXTERNAL", "advisory": "Securin Security Advisory \u2014 FINDING-009"}, "providerMetadata": {"orgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "shortName": "securin", "dateUpdated": "2026-07-09T04:36:02.166Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-01T13:14:15.623029Z", "id": "CVE-2026-7828", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-01T13:14:25.539Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7828", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-01T13:14:15.623029Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-01T13:14:22.615Z"}}], "cna": {"title": "UltraVNC repeater integer overflow in win_log malloc leading to heap overflow", "source": {"advisory": "Securin Security Advisory \u2014 FINDING-009", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Arjun Basnet, Securin (arjun.basnet@securin.io)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "uvnc", "modules": ["repeater"], "product": "UltraVNC", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.8.2.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-06-02T00:00:00.000Z", "value": "Vulnerability discovered during security audit"}, {"lang": "en", "time": "2026-06-17T00:00:00.000Z", "value": "Reported to vendor (coordinated disclosure)"}, {"lang": "en", "time": "2026-09-15T00:00:00.000Z", "value": "Planned public disclosure (90-day window)"}], "references": [{"url": "https://uvnc.com/", "name": "UltraVNC project page", "tags": ["vendor-advisory"]}, {"url": "https://github.com/ultravnc/UltraVNC", "name": "UltraVNC source repository", "tags": ["product"]}, {"url": "https://www.securin.io/zero-days/cve-2026-7828-integer-overflow-win-log-malloc-ultravnc-repeater"}], "descriptions": [{"lang": "en", "value": "UltraVNC repeater through 1.8.2.2 contains an integer overflow in the HTTP request logging path. In repeater/webgui/settings.c:336, the win_log() function allocates list nodes via malloc(sizeof(struct LIST) + strlen(line)), where line is derived from HTTP request URIs. If strlen(line) is sufficiently large, the addition overflows to a value smaller than sizeof(struct LIST), causing a heap allocation smaller than required. The subsequent strcpy of the full string into the undersized allocation produces a heap buffer overflow. In the current implementation this overflow is bounded by the HTTP receive buffer size (WI_RXBUFSIZE = 153600 bytes, well below SIZE_MAX on 32-bit builds), limiting practical exploitability to a partial heap write. A remote unauthenticated attacker can trigger the theoretical overflow path by sending a maximally-sized URI in an HTTP request to the repeater HTTP port."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "shortName": "securin", "dateUpdated": "2026-07-09T04:36:02.166Z"}}}, "cveMetadata": {"cveId": "CVE-2026-7828", "state": "PUBLISHED", "dateUpdated": "2026-07-09T04:36:02.166Z", "dateReserved": "2026-05-05T03:40:50.298Z", "assignerOrgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "datePublished": "2026-07-01T03:33:21.648Z", "assignerShortName": "securin"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["repeater"], "product": "UltraVNC", "vendor": "uvnc", "versions": [{"lessThanOrEqual": "1.8.2.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:uvnc:ultravnc:*:*:*:*:*:*:*:*", "matchCriteriaId": "593F7EC1-0922-4652-817A-7D57A0F1210D", "versionEndIncluding": "1.8.2.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "UltraVNC repeater through 1.8.2.2 contains an integer overflow in the HTTP request logging path. In repeater/webgui/settings.c:336, the win_log() function allocates list nodes via malloc(sizeof(struct LIST) + strlen(line)), where line is derived from HTTP request URIs. If strlen(line) is sufficiently large, the addition overflows to a value smaller than sizeof(struct LIST), causing a heap allocation smaller than required. The subsequent strcpy of the full string into the undersized allocation produces a heap buffer overflow. In the current implementation this overflow is bounded by the HTTP receive buffer size (WI_RXBUFSIZE = 153600 bytes, well below SIZE_MAX on 32-bit builds), limiting practical exploitability to a partial heap write. A remote unauthenticated attacker can trigger the theoretical overflow path by sending a maximally-sized URI in an HTTP request to the repeater HTTP port."}, {"lang": "es", "value": "El repetidor UltraVNC hasta la versi\u00f3n 1.8.2.2 contiene un desbordamiento de entero en la ruta de registro de solicitudes HTTP. En repeater/webgui/settings.c:336, la funci\u00f3n win_log() asigna nodos de lista a trav\u00e9s de malloc(sizeof(struct LIST) + strlen(line)), donde line se deriva de las URI de las solicitudes HTTP. Si strlen(line) es suficientemente grande, la adici\u00f3n desborda a un valor menor que sizeof(struct LIST), causando una asignaci\u00f3n de memoria din\u00e1mica (heap) menor de lo requerido. El strcpy subsiguiente de la cadena completa en la asignaci\u00f3n de tama\u00f1o insuficiente produce un desbordamiento de b\u00fafer en el heap. En la implementaci\u00f3n actual, este desbordamiento est\u00e1 limitado por el tama\u00f1o del b\u00fafer de recepci\u00f3n HTTP (WI_RXBUFSIZE = 153600 bytes, muy por debajo de SIZE_MAX en compilaciones de 32 bits), limitando la explotabilidad pr\u00e1ctica a una escritura parcial en el heap. Un atacante remoto no autenticado puede activar la ruta de desbordamiento te\u00f3rica enviando una URI de tama\u00f1o m\u00e1ximo en una solicitud HTTP al puerto HTTP del repetidor."}], "id": "CVE-2026-7828", "lastModified": "2026-10-25T17:10:00.197", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7828", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-01T13:14:15.623029Z", "version": "2.0.3"}}]}, "published": "2026-07-01T05:16:23.970", "references": [{"source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "tags": ["Product"], "url": "https://github.com/ultravnc/UltraVNC"}, {"source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "tags": ["Product", "Release Notes"], "url": "https://uvnc.com/"}, {"source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "url": "https://www.securin.io/zero-days/cve-2026-7828-integer-overflow-win-log-malloc-ultravnc-repeater"}], "sourceIdentifier": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.8.2.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "UltraVNC", "source": "cna", "vendor": "uvnc"}, "product": "ultravnc", "vendor": "uvnc"}], "created": "2026-07-01T11:00:14.967863+00:00", "updated": "2026-07-01T15:00:06.288376+00:00", "vendors": ["uvnc", "uvnc$PRODUCT$ultravnc"]}