CVE-2026-44042

{"id": "CVE-2026-44042", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44042", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-01T13:08:54.695763Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "affected": [{"source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "affectedData": [{"vendor": "uvnc", "modules": ["repeater"], "product": "UltraVNC", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.8.2.2"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-01T05:16:21.153", "references": [{"url": "https://github.com/ultravnc/UltraVNC", "tags": ["Product"], "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c"}, {"url": "https://uvnc.com/", "tags": ["Product", "Release Notes"], "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c"}, {"url": "https://www.securin.io/zero-days/cve-2026-44042-wi-uudecode-off-by-one-bounded-ultravnc-repeater", "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "description": [{"lang": "en", "value": "CWE-193"}]}], "descriptions": [{"lang": "en", "value": "UltraVNC repeater through 1.8.2.2 contains an off-by-one error in the Base64 decode helper used for HTTP Basic authentication. In repeater/webgui/webutils.c:817, the wi_uudecode() function checks whether the input length exceeds the output buffer with a strict greater-than comparison (>), while the correct check should be greater-than-or-equal (>=). When strlen(authdata) equals sizeof(decode), the decoded output length (approximately 3/4 of input) does not overflow the buffer in current practice because the outer HTTP request bounds constrain the Authorization header. However, the defective check leaves a latent off-by-one condition that could become exploitable if the buffering constraints change. The current risk is limited to a one-byte write at the boundary of a 1024-byte stack buffer under constrained conditions."}, {"lang": "es", "value": "El repetidor UltraVNC hasta la versi\u00f3n 1.8.2.2 contiene un error de \u2019off-by-one\u2019 en el asistente de decodificaci\u00f3n Base64 utilizado para la autenticaci\u00f3n b\u00e1sica HTTP. En repeater/webgui/webutils.c:817, la funci\u00f3n wi_uudecode() comprueba si la longitud de entrada excede el b\u00fafer de salida con una comparaci\u00f3n estricta de \u2019mayor que\u2019 (>), mientras que la comprobaci\u00f3n correcta deber\u00eda ser \u2019mayor o igual que\u2019 (>=). Cuando strlen(authdata) es igual a sizeof(decode), la longitud de salida decodificada (aproximadamente 3/4 de la entrada) no desborda el b\u00fafer en la pr\u00e1ctica actual porque los l\u00edmites de la solicitud HTTP externa restringen el encabezado de autorizaci\u00f3n. Sin embargo, la comprobaci\u00f3n defectuosa deja una condici\u00f3n latente de \u2019off-by-one\u2019 que podr\u00eda volverse explotable si cambian las restricciones de almacenamiento en b\u00fafer. El riesgo actual se limita a una escritura de un byte en el l\u00edmite de un b\u00fafer de pila de 1024 bytes bajo condiciones restringidas."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:uvnc:ultravnc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "593F7EC1-0922-4652-817A-7D57A0F1210D", "versionEndIncluding": "1.8.2.2"}], "operator": "OR"}]}], "sourceIdentifier": "33c584b5-0579-4c06-b2a0-8d8329fcab9c"}