CVE-2019-8259 is a high-severity memory leak vulnerability (CWE-665) affecting UltraVNC revision 1198 and various Siemens SINUMERIK products utilizing UltraVNC. An unauthenticated attacker can exploit this remotely over the network to read stack memory, potentially bypassing ASLR for information disclosure. The CVSS score is 7.5 (HIGH), indicating a significant risk. While there is no known active exploitation or publicly available exploit code in Metasploit or ExploitDB, the vulnerability has received some community discussion and media coverage. This issue has been patched in UltraVNC revision 1199.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.2.2.3CPE matchmatch criteria | cpe:2.3:a:uvnc:ultravnc:*:*:*:*:*:*:*:* | ||
< 4.8CPE matchmatch criteria | cpe:2.3:a:siemens:sinumerik_access_mymachine\/p2p:*:*:*:*:*:*:*:* | ||
< 14.00CPE matchmatch criteria | cpe:2.3:a:siemens:sinumerik_pcu_base_win10_software\/ipc:*:*:*:*:*:*:*:* | ||
<= 12.01CPE matchmatch criteria | cpe:2.3:a:siemens:sinumerik_pcu_base_win7_software\/ipc:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.