What this actually is.
Technical background, root cause, and affected surface.
In repeater/webgui/webutils.c:817, wi_uudecode() uses a strict > comparison to check whether decoded data fits in the output buffer. The correct check should be >=. At the exact boundary (strlen(authdata)==sizeof(decode)), the NUL terminator write lands one byte past the 1024-byte decode buffer. Currently bounded by HTTP header constraints.
- Vendor
- UltraVNC
- Product
- UltraVNC Repeater
- Severity
- Low
- CVSS Score
- 3.7
- Status
- Fixed
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
- CWE
- CWE-193: Off-by-one Error
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The bug, and the fix.
// webutils.c:846 if (strlen(authdata) > sizeof(decode)) goto failed; // should be >= // At exact boundary: decoded NUL written at decode[1024] — 1 byte OOB
Root cause: Strict > comparison instead of >= in buffer overflow guard. decode() function lacks explicit output buffer size parameter.
When does this fire?
All conditions must be true for the exploit to succeed.
Would require strlen(authdata) exactly equal to sizeof(decode)=1024 bytes in the Authorization header. Under normal HTTP Basic auth usage this does not occur.
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Latent off-by-one. No current exploitable path. At the exact 1024-byte boundary, NUL could write 1 byte past the decode buffer onto the stack.
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Change > to >= in the caller check. Add outbufsize parameter to wi_uudecode. Vendor fix applied: outbufsize parameter added; >= guard applied.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Timeline recorded · Disclosure coordinated by Securin
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.