CVE-2026-7831

The record

UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message handler. In vncviewer/ClientConnection.cpp, when the server-supplied nameLength equals exactly 2024 the code declares a 2024-byte stack buffer _dn[2024] and calls ReadString(_dn, 2024). ReadString writes the NUL terminator at buf[length], i.e., _dn[2024], one byte past the end of the stack buffer. A malicious VNC server can trigger this condition by advertising a desktop name of length 2024 in its ServerInit message. On release builds without stack canaries the single-byte NUL overwrite adjacent stack data. On builds with /GS stack protection the canary is corrupted and the process terminates, resulting in denial of service. User interaction (connecting the viewer to the malicious server) is required.

Affected packages

Related vulnerabilities

• CVE-2026-42618 In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in… CWE-193
• CVE-2026-106584 In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times… CWE-193
• CVE-2026-90781 alsa-lib through 1.2.16.1 contains a stack buffer overflow in the… CWE-193
• CVE-2026-86297 A vulnerability was identified in D-Link DIR-605 B1v202WWB03. CWE-193
• CVE-2026-81738 OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to… CWE-193
• CVE-2026-57160 PJSIP is a free and open source multimedia communication library written in C. CWE-193
• CVE-2026-17469 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial… CWE-193
• CVE-2026-14368 The LwM2M JSON content formatter's get_string() in subsys/net/lib/lwm2m/lwm2m_rw_json.c… CWE-193