Uvnc maintains a small portfolio of remote-access and support applications, most notably UltraVNC and PCHelpware v2, that despite modest product breadth occupy a meaningful position in the remote-desktop and technical-support software landscape. Vulnerabilities affecting the vendor skew strongly toward critical-severity outcomes and recur through a durable pattern of memory-safety weaknesses—out-of-bounds reads and writes, heap and stack buffer overflows, and out-of-bounds memory access—that reflect the low-level network protocol handling and graphics rendering inherent to VNC implementations. The concentration of critical-severity flaws in remote-access software creates significant risk for any deployment, as these products often operate with elevated privileges and sit behind network exposure. Defenders should prioritize patch deployment for this vendor's releases and audit which systems depend on these products for remote management; live exploitation activity and severity counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Uvnc over time
Signals from CVEs in this vendor scope (39 CVEs).
39 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-7840CRITICAL UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embedded HTTP administration server. The functions wi_senderr() and wi_replyhdr() in repeater/webgui/webu | Jul 1, 2026 | 9.8 | 43 | NO | NO |
CVE-2026-7838HIGH UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap buffer overflow in the RFB protocol failure-response parsing path. In vncviewer/ClientConnection.cpp, | Jul 1, 2026 | 8.8 | 40 | NO | NO |
CVE-2026-7839CRITICAL UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. In repeater/webgui/settings.c:197, when settings2.txt is absent on f | Jul 1, 2026 | 9.1 | 38 | NO | NO |
CVE-2026-7831HIGH UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message handler. In vncviewer/ClientConnection.cpp, when the server-supplied name | Jul 1, 2026 | 7.6 | 34 | NO | NO |
CVE-2019-8274CRITICAL UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer offer handler, which can potentially in result code execution. This attack a | Mar 8, 2019 | 9.8 | 33 | NO | NO |
CVE-2019-8273CRITICAL UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer request handler, which can potentially result in code execution. This attack | Mar 8, 2019 | 9.8 | 33 | NO | NO |
CVE-2026-7830HIGH UltraVNC through 1.8.2.2 uses inadequate cryptography in the MS-Logon II authentication scheme (rfbUltraVNC_MsLogonIIAuth). In rfb/dh.cpp the Diffie-Hellman key exchange is perform | Jul 1, 2026 | 7.4 | 32 | NO | NO |
CVE-2026-7829HIGH UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In repeater/webgui/settings.c:225-272, after strncpy_s copies a | Jul 1, 2026 | 7.2 | 32 | NO | NO |
CVE-2019-8264CRITICAL UltraVNC revision 1203 has out-of-bounds access vulnerability in VNC client inside Ultra2 decoder, which can potentially result in code execution. This attack appears to be exploit | Mar 8, 2019 | 9.8 | 32 | NO | NO |
CVE-2019-8260CRITICAL UltraVNC revision 1199 has a out-of-bounds read vulnerability in VNC client RRE decoder code, caused by multiplication overflow. This attack appears to be exploitable via network c | Mar 5, 2019 | 9.8 | 32 | NO | NO |
Signals from CVEs in this vendor scope (39 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Uvnc.
Media articles that mention a CVE ID that affects a product developed by Uvnc — matched by CVE ID, not by vendor name.