CVE-2026-44041 is an out-of-bounds read vulnerability in UltraVNC through version 1.8.2.2, specifically in the vncWc2Mb() function located in rfb/dh.cpp at line 204. The function calls wcslen() on a WCHAR pointer provided by the caller without performing bounds checking or ensuring the buffer is NUL-terminated. If the buffer is not properly terminated, wcslen() reads past the buffer end until it finds a NUL wchar, causing an out-of-bounds read. This can lead to information disclosure from adjacent memory or a denial of service if the read crosses a page boundary and causes a crash. Exploitation requires an unusual caller contract not typical in standard Win32 API usage. There is no vendor advisory or patch information available at this time.

The vulnerability can cause an out-of-bounds read, potentially disclosing adjacent memory contents or causing a process crash (denial of service) if the read crosses a memory page boundary. There is no indication of code execution or privilege escalation. The impact is limited and requires abnormal input conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid supplying improperly NUL-terminated wide-character buffers to the affected function if possible. Monitor vendor communications for updates.