CVE-2026-44042: uvnc ultravnc Off-by-one Error

Vulnerability summary

CVE-2026-44042 is a low (CVSS 3.7) Off-by-one Error vulnerability in uvnc ultravnc. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 40.9% of scored vulnerabilities.

Timeline

1. 01-07-2026
   PublishedVulnerability first disclosed.
2. 09-07-2026
   Last modifiedVulnerability information updated.

Description

UltraVNC repeater through 1.8.2.2 contains an off-by-one error in the Base64 decode helper used for HTTP Basic authentication. In repeater/webgui/webutils.c:817, the wi_uudecode() function checks whether the input length exceeds the output buffer with a strict greater-than comparison (>), while the correct check should be greater-than-or-equal (>=). When strlen(authdata) equals sizeof(decode), the decoded output length (approximately 3/4 of input) does not overflow the buffer in current practice because the outer HTTP request bounds constrain the Authorization header. However, the defective check leaves a latent off-by-one condition that could become exploitable if the buffering constraints change. The current risk is limited to a one-byte write at the boundary of a 1024-byte stack buffer under constrained conditions.

• CWE-193Off-by-one ErrorA product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.