CVE-2019-8262

critical

Description

UltraVNC revision 1203 has multiple heap buffer overflow vulnerabilities in VNC client code inside Ultra decoder, which results in code execution. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1204.

References

Advisories
More

https://www.us-cert.gov/ics/advisories/icsa-20-161-06

https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-008-ultravnc-heap-based-buffer-overflow/

https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf

https://us-cert.cisa.gov/ics/advisories/icsa-21-131-11

https://cert-portal.siemens.com/productcert/pdf/ssa-940818.pdf

https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf

Details

Source: Mitre, NVD

Published: 2019-03-05

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.0238