CVE-2019-8266: kaspersky lab ultravnc
Vulnerability summary
CVE-2019-8266 is a critical (CVSS 9.8) vulnerability in kaspersky lab ultravnc. EPSS estimates a 2.84% chance of exploitation in the next 30 days, higher than 86.4% of scored vulnerabilities.
Timeline
- 09-03-2019PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of ClientConnection::Copybuffer function in VNC client code, which can potentially result in code execution. This attack appears to be exploitable via network connectivity. User interaction is required to trigger these vulnerabilities. These vulnerabilities have been fixed in revision 1208.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
2.84%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
0.00 pp
From 2.84% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-788Access of Memory Location After End of BufferThe product reads or writes to a buffer using an index or pointer that references a memory location after the end of the buffer.
- CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
2 vendors · 2 products
References
3 links- cert-portal.siemens.com/productcert/pdf/ssa-927095.pdfX Refsource CONFIRM
- www.us-cert.gov/ics/advisories/icsa-20-161-06X Refsource MISC