CVE-2026-44042: Off-by-one Error in uvnc UltraVNC
UltraVNC repeater through 1.8.2.2 contains an off-by-one error in the Base64 decode helper used for HTTP Basic authentication. In repeater/webgui/webutils.c:817, the wi_uudecode() function checks whether the input length exceeds the output buffer with a strict greater-than comparison (>), while the correct check should be greater-than-or-equal (>=). When strlen(authdata) equals sizeof(decode), the decoded output length (approximately 3/4 of input) does not overflow the buffer in current practice because the outer HTTP request bounds constrain the Authorization header. However, the defective check leaves a latent off-by-one condition that could become exploitable if the buffering constraints change. The current risk is limited to a one-byte write at the boundary of a 1024-byte stack buffer under constrained conditions.
AI Analysis
Technical Summary
The vulnerability in UltraVNC repeater (up to version 1.8.2.2) is an off-by-one error in the Base64 decode helper function (wi_uudecode) used for HTTP Basic authentication. Specifically, the function checks if the input length exceeds the output buffer length with a strict greater-than comparison (>), but it should use greater-than-or-equal (>=). When the input length equals the buffer size, this check fails to prevent a one-byte overflow. Although the current HTTP request size constraints prevent exploitation, the latent off-by-one error could become exploitable if those constraints change. The issue results in a potential one-byte write at the boundary of a 1024-byte stack buffer. No known exploits are reported, and the CVSS score is 3.7 (low severity).
Potential Impact
The vulnerability could allow a one-byte buffer overflow on the stack under specific conditions related to the size of the HTTP Authorization header. Currently, the risk is limited because the HTTP request size constrains the input, preventing overflow. There is no impact on confidentiality, integrity, or availability reported beyond a low-level availability impact due to the potential for a one-byte write. No known exploits exist in the wild.
Mitigation Recommendations
No official patch or remediation is currently available. The risk is low and constrained by existing HTTP request size limits. Monitor vendor advisories for updates or patches addressing this off-by-one error. Avoid changing HTTP request size constraints that could expose this latent vulnerability.
CVE-2026-44042: Off-by-one Error in uvnc UltraVNC
Description
UltraVNC repeater through 1.8.2.2 contains an off-by-one error in the Base64 decode helper used for HTTP Basic authentication. In repeater/webgui/webutils.c:817, the wi_uudecode() function checks whether the input length exceeds the output buffer with a strict greater-than comparison (>), while the correct check should be greater-than-or-equal (>=). When strlen(authdata) equals sizeof(decode), the decoded output length (approximately 3/4 of input) does not overflow the buffer in current practice because the outer HTTP request bounds constrain the Authorization header. However, the defective check leaves a latent off-by-one condition that could become exploitable if the buffering constraints change. The current risk is limited to a one-byte write at the boundary of a 1024-byte stack buffer under constrained conditions.
CVSS v3.1
Score 3.7low
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in UltraVNC repeater (up to version 1.8.2.2) is an off-by-one error in the Base64 decode helper function (wi_uudecode) used for HTTP Basic authentication. Specifically, the function checks if the input length exceeds the output buffer length with a strict greater-than comparison (>), but it should use greater-than-or-equal (>=). When the input length equals the buffer size, this check fails to prevent a one-byte overflow. Although the current HTTP request size constraints prevent exploitation, the latent off-by-one error could become exploitable if those constraints change. The issue results in a potential one-byte write at the boundary of a 1024-byte stack buffer. No known exploits are reported, and the CVSS score is 3.7 (low severity).
Potential Impact
The vulnerability could allow a one-byte buffer overflow on the stack under specific conditions related to the size of the HTTP Authorization header. Currently, the risk is limited because the HTTP request size constrains the input, preventing overflow. There is no impact on confidentiality, integrity, or availability reported beyond a low-level availability impact due to the potential for a one-byte write. No known exploits exist in the wild.
Mitigation Recommendations
No official patch or remediation is currently available. The risk is low and constrained by existing HTTP request size limits. Monitor vendor advisories for updates or patches addressing this off-by-one error. Avoid changing HTTP request size constraints that could expose this latent vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- securin
- Date Reserved
- 2026-05-05T03:40:37.003Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a44a07a27e9c79719fbd715
Added to database: 07/01/2026, 05:07:06 UTC
Last enriched: 07/08/2026, 12:53:22 UTC
Last updated: 08/15/2026, 12:41:09 UTC
Views: 195
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.