CVE-2019-8266

CVE-2019-8266 Vulnerability Analysis & Exploit Intelligence

UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of ClientConnection::Copybuffer function in VNC client code, which can potentially result in code execution. This attack appears to be exploitable via network connectivity. User interaction is required to trigger these vulnerabilities. These vulnerabilities have been fixed in revision 1208.

Published Mar 9, 2019Updated Sep 16, 2024Sources: cvelistV5, Kaspersky

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the scoring sources call it.

Exploitation

Unreported

no source claims exploitation

EPSS

chance of exploitation in 30 days

Affects

kaspersky lab

ultravnc

CVSS base

Unscored

no source published a base score

Affected scope

The catalog records vendors and products as separate lists, not pairs, so which product belongs to which vendor is not something this page can say.

Vendors (1)

kaspersky lab

Products (1)

ultravnc

Weakness & attack patterns

CWE-788

References

3 on the record

ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-013-ultravnc-access-of-memory-location-after-end-of-buffer/
x_refsource_MISC
cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf
x_refsource_CONFIRM
www.us-cert.gov/ics/advisories/icsa-20-161-06
x_refsource_MISC

Elsewhere on this site

kaspersky labevery CVE for this vendor
CWE-788other pages naming this weakness

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
No exploit packet captures, log samples, or incident case IDs supplied.