CVE-2026-3787

The record

A weakness has been identified in UltraVNC 1.6.4.0 on Windows. This affects an unknown function in the library cryptbase.dll of the component Windows Service. This manipulation causes uncontrolled search path. The attack requires local access. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The vendor was contacted early about this disclosure but did not respond in any way.

Affected packages

Related vulnerabilities

• CVE-2026-119333 draw.io Desktop is the official Electron build of draw.io. CWE-426
• CVE-2026-116243 pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets… CWE-426
• CVE-2026-57203 Asterisk is an open source private branch exchange and telephony toolkit. CWE-426
• CVE-2026-105477 A vulnerability in Veeam Agent for Linux allows for local privilege escalation. CWE-426
• CVE-2026-113461 Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to… CWE-426
• CVE-2026-83509 Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to… CWE-426
• CVE-2026-83506 Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate… CWE-426
• CVE-2026-83505 Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows… CWE-426