Skip to main content

Critical Vulnerabilities in UltraVNC Repeater Component

The critical vulnerabilities could allow a remote attacker either to obtain administrative control of the service through a hard-coded credential (CVE-2026-7839) or achieve unauthenticated arbitrary code execution (CVE-2026-7840)

Threat ID:
CC-4807
Threat Severity:
Medium
Published:
2 July 2026 3:18 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

The critical vulnerabilities could allow a remote attacker either to obtain administrative control of the service through a hard-coded credential (CVE-2026-7839) or achieve unauthenticated arbitrary code execution (CVE-2026-7840)

Threat details

At the time of writing, there is no confirmed evidence of active exploitation for these vulnerabilities. However, both issues are remotely exploitable without authentication and could present significant risk to vulnerable devices.

The affected component is the UltraVNC Repeater, which is designed to broker remote connections between UltraVNC clients and servers. Organisations using UltraVNC for remote support, administration, supplier access, or operational support should determine whether vulnerable repeater instances are deployed and whether they are reachable from untrusted networks.

Introduction

Two critical vulnerabilities affecting UltraVNC Repeater were published. 

  • CVE-2026-7839 - "Use of Hard-coded Credentials" vulnerability - CVSSv3 score: 9.1
    Successful exploitation could allow a remote, unauthenticated attacker with access to the repeater HTTP port (default TCP 80) to authenticate using the known default credential and gain administrative control of the repeater.

  • CVE-2026-7840 - "Out-of-bounds Write" vulnerability - CVSSv3 score: 9.8
    Successful exploitation could allow a remote, unauthenticated attacker to corrupt memory and execute arbitrary code on the host running the repeater.

Organisations operating internet-facing or operationally important UltraVNC Repeater instances should prioritise identification and remediation activities due to the combination of network accessibility, low attack complexity, and potentially significant organisational impact.

Remediation advice

Affected organisations are encouraged to review the Github Advisory Database for CVE-2026-7839 and the Github Advisory Database for CVE-2026-7840. Updates to 1.8.2.4 are available on the UltraVNC download page and should be applied as soon as possible. 

CVE Vulnerabilities

Status Published

CVE-2026-7839

UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. In repeater/webgui/settings.c:197, when settings2.txt is absent on first run the repeater writes the literal string "adminadmi2" as the admin password via strcpy_s(saved_password, 64, "adminadmi2"). The HTTP Basic-auth handler wi_decode_auth() checks this password without rate-limiting or lockout. Any remote attacker who can reach the repeater HTTP port (default TCP 80) can authenticate as administrator using the well-known default credential on a fresh or unmodified installation, gaining full control of the repeater configuration including allow/deny rules and session visibility.
Status Published

CVE-2026-7840

UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embedded HTTP administration server. The functions wi_senderr() and wi_replyhdr() in repeater/webgui/webutils.c write the caller-supplied HTTP request URI into a fixed 1000-byte global buffer (hdrbuf) via unchecked sprintf calls. The HTTP receive buffer accepts URIs up to approximately 150 KB (WI_RXBUFSIZE = 153600), so an unauthenticated attacker who can reach the repeater HTTP port (default TCP 80) can overflow hdrbuf by at least 500 bytes with a single HTTP request containing a URI of 1500 bytes or longer, corrupting adjacent .bss-segment globals. The overflow occurs before any authentication check, making it reachable without credentials. A remote, unauthenticated attacker can achieve arbitrary code execution on the host running the repeater.

Last edited: 2 July 2026 3:18 pm