CVE-2026-44041 is an out-of-bounds read vulnerability in UltraVNC through version 1.8.2.2. The issue arises in the vncWc2Mb() function located in rfb/dh.cpp at line 204, where a caller-supplied WCHAR pointer is passed to wcslen() without bounds checking or ensuring NUL termination. If the input buffer is not properly NUL-terminated, wcslen() reads past the buffer boundary until it finds a NUL wide character, causing an out-of-bounds read. This can result in either a denial of service due to process crash if the read crosses a page boundary or limited information disclosure from adjacent memory. The vulnerability requires an abnormal caller contract uncommon in typical Win32 API usage. There is no vendor advisory or patch information available at this time.

The vulnerability can lead to a denial of service via process crash if the out-of-bounds read crosses a memory page boundary. Additionally, there is a potential for limited information disclosure from adjacent memory regions. There is no indication of privilege escalation, code execution, or broader impact. Exploitation requires abnormal input conditions that are not typical in normal usage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid supplying or processing improperly NUL-terminated wide-character buffers in the affected function. No official mitigation or workaround has been published.