CVE-2026-7838 describes an integer overflow in UltraVNC viewer (up to 1.8.2.2) within the RFB protocol failure-response parsing code. Specifically, the 4-byte network-supplied reasonLen field is used in an addition that overflows when reasonLen equals 0xFFFFFFFF, causing an undersized buffer allocation. Subsequent reading of the large reasonLen value into this small buffer results in a heap buffer overflow. This vulnerability can be triggered by a malicious VNC server or a man-in-the-middle during authentication failure messages, potentially leading to remote code execution under the context of the viewer user. The issue was verified using AddressSanitizer.

A remote attacker controlling a VNC server or positioned as a man-in-the-middle can exploit this vulnerability to cause a heap buffer overflow in the UltraVNC viewer. This may lead to a crash or remote code execution with the privileges of the user running the viewer. The vulnerability affects the authentication failure message handling, allowing exploitation without successful authentication.

No official patch or remediation is currently available for this vulnerability. Users should exercise caution when connecting to untrusted VNC servers or networks where man-in-the-middle attacks are possible. Monitor the vendor's advisory channels for updates and apply patches once released.