CVE-2026-7830
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk8th percentile — higher than 8% of all known CVEs
Summary
UltraVNC up to version 1.8.2.2 uses weak cryptography in the MS-Logon II authentication scheme. The Diffie-Hellman key exchange relies on 64-bit parameters that can be broken in under a second, and the random number generator based on rand() with a time seed allows private key recovery within a minute. A network attacker can derive the shared DH key and decrypt the username and password.
Risk Assessment
The organization is at risk of full credential disclosure (username and password) during MS-Logon II connections. An attacker can hijack VNC sessions, leading to unauthorized system access and potential privilege escalation.
Recommendation
Immediately upgrade UltraVNC to a version newer than 1.8.2.2 or switch to MS-Logon III (X25519 + AES-256-GCM), which is not affected. If an upgrade is not possible, disable MS-Logon II authentication and use stronger methods.
Original NVD description (English source)
UltraVNC through 1.8.2.2 uses inadequate cryptography in the MS-Logon II authentication scheme (rfbUltraVNC_MsLogonIIAuth). In rfb/dh.cpp the Diffie-Hellman key exchange is performed with parameters that fit in an unsigned 64-bit integer (DH_MAX_BITS controls the prime size). A 64-bit DH key can be broken by Pollard's rho algorithm in under one second on current hardware. Additionally, the private exponent is generated by the rng() function, which multiplies three libc rand() values seeded from time(NULL). With approximately 31 bits of internal state and a time-based seed, the private exponent is recoverable in under a minute by a passive observer. A network attacker who can observe the MS-Logon II handshake (via sniffing, recording, or man-in-the-middle) can derive the shared DH key and decrypt the encapsulated username and password, resulting in full credential disclosure. This affects legacy MS-Logon II connections; MS-Logon III (X25519 + AES-256-GCM) is unaffected.