Vulnerability Description
UltraVNC repeater through 1.8.2.2 contains an off-by-one error in the Base64 decode helper used for HTTP Basic authentication. In repeater/webgui/webutils.c:817, the wi_uudecode() function checks whether the input length exceeds the output buffer with a strict greater-than comparison (>), while the correct check should be greater-than-or-equal (>=). When strlen(authdata) equals sizeof(decode), the decoded output length (approximately 3/4 of input) does not overflow the buffer in current practice because the outer HTTP request bounds constrain the Authorization header. However, the defective check leaves a latent off-by-one condition that could become exploitable if the buffering constraints change. The current risk is limited to a one-byte write at the boundary of a 1024-byte stack buffer under constrained conditions.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Uvnc | Ultravnc | <= 1.8.2.2 |
Related Weaknesses (CWE)
References
- https://github.com/ultravnc/UltraVNCProduct
- https://uvnc.com/ProductRelease Notes
- https://www.securin.io/zero-days/cve-2026-44042-wi-uudecode-off-by-one-bounded-u
FAQ
What is CVE-2026-44042?
CVE-2026-44042 is a vulnerability with a CVSS score of 3.7 (LOW). UltraVNC repeater through 1.8.2.2 contains an off-by-one error in the Base64 decode helper used for HTTP Basic authentication. In repeater/webgui/webutils.c:817, the wi_uudecode() function checks whet...
How severe is CVE-2026-44042?
CVE-2026-44042 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-44042?
Check the references section above for vendor advisories and patch information. Affected products include: Uvnc Ultravnc.