UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap buffer overflow in the RFB protocol failure-response parsing path. In vncviewer/C…

UltraVNC viewer versions through 1.8.2.2 contain a critical integer overflow vulnerability in the RFB protocol failure-response parsing path. The flaw exists in vncviewer/ClientConnection.cpp where the network-supplied reasonLen field (CARD32) is passed as reasonLen+1 to CheckBufferSize(), causing an unsigned 32-bit integer overflow when reasonLen equals 0xFFFFFFFF. This overflow results in only 256 bytes being allocated, while the subsequent ReadString call attempts to read up to 4 GiB of data into that buffer. The vulnerability is reachable without authentication via rfbConnFailed and rfbVncAuthFailed message types. A malicious VNC server or man-in-the-middle attacker can trigger this when a victim viewer connects. Successful exploitation can lead to remote code execution as the user running the viewer. The heap buffer overflow was confirmed with AddressSanitizer showing a WRITE at offset 256.