PatchTheCVEultravnc vulnerabilities and fixes
Recent CVEs affecting ultravnc, with upgrade or downgrade steps. 10 tracked.
ultravnc has 10 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 10. Most recent: 2026-07-01. Highest priority: CVE-2026-7840 (score 61/100).
- CVE-2026-7840 CRITICAL 9.8 UPGRADE UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embedded HTTP administration server
- CVE-2026-7838 HIGH 8.8 UPGRADE UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap buffer overflow in the RFB prot
- CVE-2026-7839 CRITICAL 9.1 UPGRADE UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded default password
- CVE-2026-7828 MEDIUM 5.3 UPGRADE UltraVNC repeater through 1.8.2.2 contains an integer overflow in the HTTP request logging path
- CVE-2026-7829 HIGH 7.2 UPGRADE UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule pa
- CVE-2026-7831 HIGH 7.6 UPGRADE UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message han
- CVE-2026-7830 HIGH 7.4 UPGRADE UltraVNC through 1.8.2.2 uses inadequate cryptography in the MS-Logon II authentication scheme (rfbUltraVNC_Ms
- CVE-2026-44040 MEDIUM 4.8 UPGRADE UltraVNC through 1.8.2.2 uses a cryptographically weak pseudo-random number generator to produce VNC authentic
- CVE-2026-44042 LOW 3.7 UPGRADE UltraVNC repeater through 1.8.2.2 contains an off-by-one error in the Base64 decode helper used for HTTP Basic
- CVE-2026-44041 MEDIUM 4.3 UPGRADE UltraVNC through 1.8.2.2 contains an out-of-bounds read in the wide-string to multibyte conversion helper
FAQ
How do I fix ultravnc vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is ultravnc being exploited right now?
None of the tracked ultravnc CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which ultravnc CVE should I patch first?
CVE-2026-7840 currently ranks highest (61/100): UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embedded HTTP administration server.