What this actually is.
Technical background, root cause, and affected surface.
In repeater/webgui/settings.c, after strncpy_s copies a rule token into temp1[rule1] (25-byte destination), the code unconditionally writes temp1[rule1][len]=0 without clamping len to the destination size. When an admin saves a rule with a token of 25+ bytes, the NUL byte is written 1+ bytes past the 25-byte stack array boundary. Same pattern at lines 248 and 264 (destSize=16).
- Vendor
- UltraVNC
- Product
- UltraVNC Repeater
- Severity
- High
- CVSS Score
- 7.2
- Status
- Fixed
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-787: Out-of-bounds Write
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
No standalone exploit. Chain with CVE-2026-7839 (admin:adminadmi2): POST admin rule via HTTP UI with 25-byte token → NUL written at stack offset 25 → stack corruption.
The bug, and the fix.
strncpy_s(temp1[rule1], 25, pos, len); // settings.c:232 — truncates at 24 temp1[rule1][len] = 0; // OOB NUL when len >= 25 // Same pattern at lines 248, 264 (destSize=16)
Root cause: Direct array index write temp1[rule1][len]=0 not guarded by destination size (25). strncpy_s prevents buffer overread but does not prevent the unconditional subsequent write. Pattern repeated at three call sites.
When does this fire?
All conditions must be true for the exploit to succeed.
Attacker authenticates to HTTP admin (default credentials CVE-2026-7839 or compromised account). 2. Submits allow/deny rule via web UI with a token ≥25 characters. 3. Parser calls strncpy_s then writes token[len]=0 at out-of-bounds stack location.
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Stack corruption via single NUL byte write past array boundary. When chained with default password (CVE-2026-7839), yields post-auth code execution on the repeater host.
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Clamp len to destSize-1 before the NUL write. Vendor fix: if (len >= 25) len = 24; added before each NUL-write site; same for 16-byte destinations.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Timeline recorded · Disclosure coordinated by Securin
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.