Unscored severity · published Oct 21, 2026
CVE-2026-82987
No description published yet
New
–
CVSS
0.3%
EPSS
No
On KEV
Description
There exists a screen capture endpoint in vCast media streaming service in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to capture and exfiltrate the current screen content via GET requests to an unauthenticated /snapshot or /screen endpoint returning JPEGs
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VC
vCast · Viewsonic
v0.0.0 through v3.2.715 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-82987
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-82987
blog.l3afs.space
https://blog.l3afs.space/posts/Vcast-Viewsonic-RCE-chain/
kb.cert.org
https://kb.cert.org/vuls/id/234131
More from vCast
9.8
CVE-2026-82989
There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input into service…
7.5
CVE-2026-82988
There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged APK…