CVE-2026-7840: UltraVNC repeater HTTP server global buffer overflow via long URI (pre-auth RCE)

Synopsis

A global buffer overflow in UltraVNC repeater's embedded HTTP administration server allows a remote, unauthenticated attacker to execute arbitrary code on the host. The flaw exists in the wi_senderr() and wi_replyhdr() functions, which copy a caller-supplied HTTP request URI into a fixed 1000-byte global buffer without bounds checking; an attacker sends a single HTTP request with a URI of 1500 bytes or more to overflow the buffer before any authentication check runs. Successful exploitation gives the attacker full code execution on the machine running the repeater. No upstream fix has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment a fix version is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the UltraVNC repeater HTTP administration port (default TCP 80) over the network; any internet-exposed or internally reachable deployment is in scope.

• AuthenticationNot required

  The overflow occurs before any authentication check runs, so no credentials of any privilege level are needed.

• Victim interactionNot required

  The attack is fully server-side; no user action or social engineering is required.

• Attack complexityDetail

  Exploitation is reliable and condition-free: sending a single HTTP request with a URI of 1500 bytes or more is sufficient to trigger the overflow, with no race conditions or special memory-layout requirements.

Blast Radius

• Reads memory contents from adjacent .bss-segment globals, which may include session state, connection metadata, or configuration values held in the repeater process.
• Corrupts adjacent global variables in the .bss segment, allowing an attacker to manipulate repeater behavior, redirect VNC sessions, or destabilize the service.
• Achieves arbitrary code execution on the host running the UltraVNC repeater, gaining the same OS-level privileges as the repeater process.
• Compromises the host as a pivot point, giving the attacker access to VNC sessions brokered through the repeater and potentially to the broader internal network.