uvnc UltraVNC up to 1.8.2.2 Header webutils.c wi_uudecode Authorization off-by-one

Summaryinfo

A vulnerability was found in uvnc UltraVNC up to 1.8.2.2 and classified as problematic. The affected element is the function wi_uudecode of the file repeater/webgui/webutils.c of the component Header Handler. Executing a manipulation of the argument Authorization can lead to off-by-one. This vulnerability is handled as CVE-2026-44042. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability has been found in uvnc UltraVNC up to 1.8.2.2 and classified as problematic. This vulnerability affects the function wi_uudecode of the file repeater/webgui/webutils.c of the component Header Handler. The manipulation of the argument Authorization with an unknown input leads to a off-by-one vulnerability. The CWE definition for the vulnerability is CWE-193. A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value. As an impact it is known to affect availability. CVE summarizes:

UltraVNC repeater through 1.8.2.2 contains an off-by-one error in the Base64 decode helper used for HTTP Basic authentication. In repeater/webgui/webutils.c:817, the wi_uudecode() function checks whether the input length exceeds the output buffer with a strict greater-than comparison (>), while the correct check should be greater-than-or-equal (>=). When strlen(authdata) equals sizeof(decode), the decoded output length (approximately 3/4 of input) does not overflow the buffer in current practice because the outer HTTP request bounds constrain the Authorization header. However, the defective check leaves a latent off-by-one condition that could become exploitable if the buffering constraints change. The current risk is limited to a one-byte write at the boundary of a 1024-byte stack buffer under constrained conditions.

The weakness was released by Arjun Basnet. This vulnerability was named CVE-2026-44042 since 05/05/2026. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 07/01/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Connectivity Software

Vendor

• uvnc

Name

• UltraVNC

Version

• 1.8.2.0
• 1.8.2.1
• 1.8.2.2

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion