Stack-based buffer overflow in the ClientConnection::NegotiateProtocolVersion function in vncviewer/ClientConnection.cpp in vncviewer for U…

Published 18 y ago 2008-02-06 · modified 4 mo ago 2026-06-16 · JSON

CVSS

9.3

v2.0 · NVD

CISA KEV

not known exploited

EPSS

38.8%

percentile 99%

Public exploits

Metasploit · Exploit-DB

Stack-based buffer overflow in the ClientConnection::NegotiateProtocolVersion function in vncviewer/ClientConnection.cpp in vncviewer for UltraVNC 1.0.2 and 1.0.4 before 01252008, when in LISTENING mode or when using the DSM plugin, allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a modified size value.

Exploit prediction (EPSS)

38.76% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.

Exploits and detections

Metasploit exploit/windows/vnc/ultravnc_viewer_bof UltraVNC 1.0.2 Client (vncviewer.exe) Buffer Overflow · metasploit exploit, normal rank · 2008-02-06
EDB-18666 UltraVNC 1.0.2 Client - 'vncviewer.exe' Remote Buffer Overflow (Metasploit) · remote · 2012-03-26

CVSS scores

Assigned by	Version	Score	Vector
NVD	2.0	9.3	`AV:N/AC:M/Au:N/C:C/I:C/A:C`

Classification

Weakness

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

sourceforge.net /project/shownotes.php?release_id=571174&group_id=63887 · x_refsource_CONFIRM, x_transferred
securityfocus.com /bid/27561 · vdb-entry, x_refsource_BID, x_transferred
kb.cert.org /vuls/id/721460 · third-party-advisory, x_refsource_CERT-VN, x_transferred
secunia.com /advisories/28747 · third-party-advisory, x_refsource_SECUNIA, x_transferred
forum.ultravnc.info /viewtopic.php?t=11850 · x_refsource_CONFIRM, x_transferred
ultravnc.svn.sourceforge.net /viewvc/ultravnc/UltraVNC%20Project%20Root/UltraVNC/vncviewer/ClientConnection.cpp?sortby= · x_refsource_CONFIRM, x_transferred
exploit-db.com /exploits/18666 · exploit, x_refsource_EXPLOIT-DB, x_transferred
securitytracker.com /id?1019293 · vdb-entry, x_refsource_SECTRACK, x_transferred
vupen.com /english/advisories/2008/0392 · vdb-entry, x_refsource_VUPEN, x_transferred

Sources

CVE List: CVE-2008-0610
NVD: CVE-2008-0610

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.