CVE-2026-7828 describes an integer overflow in UltraVNC repeater (up to version 1.8.2.2) in the HTTP request logging path. The win_log() function allocates memory using malloc(sizeof(struct LIST) + strlen(line)), where line is derived from the HTTP request URI. If strlen(line) is large enough, the addition overflows, causing malloc to allocate less memory than needed. This leads to a heap buffer overflow when strcpy copies the full string into the undersized buffer. The overflow is bounded by the HTTP receive buffer size (153600 bytes), limiting exploitability to a partial heap write. The vulnerability can be triggered remotely without authentication by sending a maximally-sized URI to the repeater HTTP port.

The vulnerability allows a remote unauthenticated attacker to cause a heap buffer overflow via a specially crafted HTTP request URI. The overflow is limited in size by the HTTP receive buffer, which restricts the impact to a partial heap write. There is no direct confidentiality or integrity impact reported, but availability impact is rated as low (denial of service or crash). No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Until a patch is available, restricting access to the repeater HTTP port or filtering unusually large HTTP request URIs may reduce exposure.