CVE-2026-44040
Uvnc Ultravnc ≤ 1.8.2.2
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NSummary
CVE-2026-44040 is a medium-severity PRNG (CWE-338) vulnerability in Uvnc Ultravnc. Its CVSS base score is 4.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique VNC (T1021.005); ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-12 (Cryptographic Key Establishment and Management) and SC-13 (Cryptographic Protection) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-40879
Vulnerability Data
UltraVNC through 1.8.2.2 uses a cryptographically weak pseudo-random number generator to produce VNC authentication challenge bytes. In rfb/vncauth.c:119-129, the vncRandomBytes() function seeds libc rand() with time(0) + getpid() + rand() and generates a 16-byte challenge. The combined seed space is…
more
approximately 31 bits (libc rand() internal state) and is entirely determined by publicly-observable values (wall-clock time and process ID). An attacker who can observe the authentication exchange can enumerate the seed space and predict the challenge within seconds, enabling forgery or offline brute-forcing of responses. Note: on Windows, the active code path may use vncEncryptBytes2.cpp which calls CryptGenRandom; reachability on shipped Windows binaries requires compile-graph verification and is under investigation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Weak VNC challenge generation directly enables unauthorized remote access via VNC (T1021.005) and abuse of external remote desktop services (T1133).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Mandates use of FIPS-validated cryptographic modules and approved random-bit generators, directly eliminating the weak libc-rand seeding used for VNC challenges.
Requires cryptographically strong key/nonce establishment and management practices, which encompass the generation of unpredictable authentication challenges.
Specifies secure generation, distribution and management of authenticators, covering the creation of VNC challenge bytes that must resist prediction.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices explicitly require cryptographically strong RNG selection and usage in security contexts.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Mandates use of approved cryptographic controls, directly requiring cryptographically strong RNGs.
Security testing can detect use of weak random number generators.
Secure SDLC processes should catch weak PRNG usage during design and code review.
Application security requirements can specify cryptographically strong random number generation.
Secure engineering principles include selection of appropriate cryptographic primitives.
Secure coding standards prohibit use of weak PRNGs in security contexts.