uvnc

UltraVNC repeater HTTP server global buffer overflow via long URI (pre-auth RCE)

UltraVNC repeater ships hardcoded default admin password allowing unauthenticated admin access

UltraVNC viewer heap buffer overflow via integer overflow in RFB connection-failure reason length

UltraVNC viewer off-by-one stack overflow in ServerInit desktop name parsing

UltraVNC MS-Logon II uses 64-bit Diffie-Hellman and seeded libc rand() enabling credential interception

UltraVNC repeater authenticated out-of-bounds write in rule parser via oversized token

UltraVNC repeater integer overflow in win_log malloc leading to heap overflow

UltraVNC vncauth.c uses time-seeded libc rand() to generate VNC authentication challenge bytes

UltraVNC vncWc2Mb calls wcslen() before validating that the wide string is NUL-terminated

UltraVNC repeater wi_uudecode off-by-one in base64 decode boundary check