Read the docs
TI-2022-08564 Aliases CVE-2022-24750

Low privilege user is able to exploit the service and gain SYSTEM privileges in UltraVNC server

Priority MEDIUM 40CWE-269Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

UltraVNC is a free and open source remote pc access software. A vulnerability has been found in versions prior to 1.3.8.0 in which the DSM plugin module, which allows a local authenticated user to achieve local privilege escalation (LPE) on a vulnerable system. The vulnerability has been fixed to allow loading of plugins from the installed directory. Affected users should upgrade their UltraVNC to 1.3.8.1. Users unable to upgrade should not install and run UltraVNC server as a service. It is advisable to create a scheduled task on a low privilege account to launch WinVNC.exe instead. There are no known workarounds if winvnc needs to be started as a service.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00273 19th percentileScored 2026-11-07
Fix Fixed UltraVNC (ultravnc): 1.3.8.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UltraVNCUltraVNCbefore 1.3.8.01.3.8.0Patch availableCNA
  • UltraVNC VendorUltraVNC Affected before 1.3.8.0 Fixed in 1.3.8.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:uvnc:ultravnc:*:*:*:*:*:*:*:*before 1.3.8.1Vulnerableuvnc
  • cpe:2.3:a:uvnc:ultravnc:*:*:*:*:*:*:*:* Versions before 1.3.8.1 Vulnerable ·uvnc

Remediation

  • Fix · CNA UltraVNC (ultravnc) Fixed in 1.3.8.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24750

References

Patch 2

Advisory 1

  • TI-2006-01599 Multiple buffer overflows in (a) UltraVNC (aka Ultr@VNC) 1.0.1 and earlier and (b)… CVSS 2.0HIGH 9.0
  • TI-2008-00582 Stack-based buffer overflow in the ClientConnection::NegotiateProtocolVersion function in… CVSS 2.0HIGH 9.3
  • TI-2009-00368 Multiple integer signedness errors in (1) UltraVNC 1.0.2 and 1.0.5 and (2) TightVnc 1.3.9… CVSS 2.0HIGH 10.0
  • TI-2019-05934 Heap-based buffer overflow in UltraVNC CVSS 3.1CRITICAL 9.8
  • TI-2019-05930 Heap-based buffer overflow in UltraVNC CVSS 3.1CRITICAL 9.8
  • TI-2008-04755 Multiple stack-based buffer overflows in multiple functions in vncviewer/FileTransfer.cpp… CVSS 2.0HIGH 9.3
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences