CVE-2026-7840 is a critical buffer overflow vulnerability in UltraVNC repeater through version 1.8.2.2. The embedded HTTP administration server uses a fixed 1000-byte global buffer (hdrbuf) for HTTP request URIs, but the HTTP receive buffer accepts URIs up to approximately 150 KB. The functions wi_senderr() and wi_replyhdr() write the URI into hdrbuf using unchecked sprintf calls, enabling an attacker to overflow hdrbuf by at least 500 bytes with a single HTTP request containing a URI of 1500 bytes or longer. This overflow corrupts adjacent .bss-segment globals and occurs before any authentication, allowing unauthenticated remote code execution on the repeater host.

An unauthenticated remote attacker who can reach the repeater's HTTP port (default TCP 80) can exploit this vulnerability to cause a global buffer overflow, leading to corruption of memory adjacent to the buffer. This can result in arbitrary code execution on the host running the UltraVNC repeater, potentially compromising the system completely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the UltraVNC repeater HTTP administration port to trusted networks only to prevent unauthenticated remote exploitation.