CVE-2026-7840 is a critical buffer overflow vulnerability in UltraVNC repeater's embedded HTTP administration server (up to version 1.8.2.2). The functions wi_senderr() and wi_replyhdr() write the HTTP request URI into a fixed-size 1000-byte global buffer (hdrbuf) using unchecked sprintf calls. Since the HTTP receive buffer accepts URIs up to approximately 150 KB, an attacker can send a single HTTP request with a URI of 1500 bytes or more to overflow hdrbuf by at least 500 bytes, corrupting adjacent .bss-segment globals. This overflow happens before any authentication, enabling unauthenticated remote code execution on the repeater host.

A remote unauthenticated attacker who can access the repeater's HTTP port (default TCP 80) can exploit this vulnerability to cause a buffer overflow, leading to memory corruption and potentially arbitrary code execution on the affected system. This compromises the confidentiality, integrity, and availability of the host running the UltraVNC repeater.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the UltraVNC repeater HTTP administration port to trusted networks only to prevent unauthenticated remote exploitation.