High severity · published Mar 8, 2026
CVE-2026-3787
UltraVNC Windows Service cryptbase.dll uncontrolled search path
7.0
CVSS
0.2%
EPSS
No
On KEV
Description
A weakness has been identified in UltraVNC 1.6.4.0 on Windows. This affects an unknown function in the library cryptbase.dll of the component Windows Service. This manipulation causes uncontrolled search path. The attack requires local access. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UL
UltraVNC · Ultravnc
1.6.4.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-3787
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-3787
Permissions Required
https://drive.google.com/file/d/14ixv_1i4D2VrZWyl4RKsvFcN1AMF_qNx/view
Permissions Required
https://vuldb.com/?ctiid.349754
Third Party Advisory
https://vuldb.com/?id.349754
Third Party Advisory
https://vuldb.com/?submit.767257
More from UltraVNC
9.8
CVE-2019-8258
UltraVNC revision 1198 has a heap buffer overflow vulnerability in VNC client code which results code execution
9.8
CVE-2019-8262
UltraVNC revision 1203 has multiple heap buffer overflow vulnerabilities in VNC client code inside Ultra decoder, which results in code execution
9.8
CVE-2019-8261
UltraVNC revision 1199 has a out-of-bounds read vulnerability in VNC code inside client CoRRE decoder, caused by multiplication overflow
9.8
CVE-2019-8260
UltraVNC revision 1199 has a out-of-bounds read vulnerability in VNC client RRE decoder code, caused by multiplication overflow
9.8
CVE-2018-15361
UltraVNC revision 1198 has a buffer underflow vulnerability in VNC client code, which can potentially result in code execution