CVE-2026-7838 is an integer overflow vulnerability in UltraVNC viewer (up to version 1.8.2.2) within the RFB protocol failure-response parsing path. Specifically, the 4-byte network-supplied reasonLen field (CARD32) is used in a calculation that overflows when reasonLen is 0xFFFFFFFF, leading to an under-allocated buffer of 256 bytes. Subsequent reading of reasonLen bytes into this buffer causes a heap buffer overflow. This vulnerability can be triggered by a malicious VNC server or a man-in-the-middle during authentication failure messages (rfbConnFailed and rfbVncAuthFailed), potentially resulting in remote code execution with the privileges of the user running the viewer. The issue was confirmed with AddressSanitizer on a test harness.

A remote attacker controlling a VNC server or positioned as a man-in-the-middle can exploit this vulnerability to cause a heap buffer overflow in the UltraVNC viewer, potentially leading to remote code execution under the context of the user running the viewer. This can compromise the victim system without requiring prior authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid connecting to untrusted VNC servers and consider network-level protections to prevent man-in-the-middle attacks. Monitor vendor channels for updates and apply patches promptly once released.