CVE-2026-7828 is an integer overflow vulnerability in UltraVNC repeater (up to version 1.8.2.2) within the HTTP request logging path. The win_log() function allocates memory for list nodes using malloc(sizeof(struct LIST) + strlen(line)), where 'line' is derived from HTTP request URIs. If strlen(line) is large enough, the addition overflows, causing malloc to allocate less memory than needed. Subsequently, strcpy copies the full string into this undersized buffer, causing a heap buffer overflow. The overflow is bounded by the HTTP receive buffer size (153600 bytes), limiting exploitability to a partial heap write. This vulnerability can be triggered remotely without authentication by sending a maximally-sized URI in an HTTP request to the repeater HTTP port. No known exploits are reported in the wild and no vendor patch or official remediation is documented.

The vulnerability allows a remote unauthenticated attacker to cause a heap buffer overflow via a specially crafted HTTP request URI. The overflow is limited in size by the HTTP receive buffer, resulting in a partial heap overwrite. The CVSS score of 5.3 reflects a medium severity with no confidentiality or integrity impact but potential availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the repeater HTTP port to trusted sources or disabling the HTTP logging feature if possible to reduce exposure.