CVE-2006-1652: UltraVNC and tabbed_viewer buffer overflows in logging routines

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 9.0 with public exploit code and a very high EPSS score, though the client-side code execution requires user-assisted connection to a malicious server.

What it is

UltraVNC 1.0.1 and earlier and tabbed_viewer 1.29 contain multiple buffer overflows in Log::ReallyPrint and VNCLog::ReallyPrint. A malicious VNC server can send a long string to a connecting client on TCP 5900 to execute arbitrary code, and a long HTTP GET to TCP 5800 can crash the server. The flaws affect both client and server roles and carry a CVSS v2 score of 9.0.

Impact

An attacker can execute arbitrary code on a connecting VNC client, or cause a denial of service by crashing the server. Successful code execution gives the attacker the privileges of the affected process.

Attack surface

Reached over the network: the code execution path requires a client to connect to a malicious server on TCP 5900 (user-assisted), while the DoS path is a direct long HTTP GET to TCP 5800. No authentication is required for the server-side DoS; the client-side overflow depends on the victim initiating a connection.

Exploitation

CISA KEV does not list this CVE, but EPSS is 0.67398 (99.27th percentile) and public exploit references exist on SecurityFocus and Exploit-DB, indicating mature public exploit code.

What to do

• Upgrade UltraVNC and tabbed_viewer to versions later than 1.0.1 and 1.29 respectively, or apply the vendor fix.
• Restrict outbound VNC client connections to trusted servers and block TCP 5900/5800 where not required.
• Do not expose VNC HTTP or RFB ports to untrusted networks; place them behind VPN or authenticated jump hosts.
• Run VNC clients and servers with least privilege to limit the impact of code execution.
• Monitor for and remove unsupported or end-of-life VNC viewer builds from endpoints.

Detection

• Monitor network traffic for oversized strings or malformed requests to TCP 5900 and 5800.
• Alert on VNC client processes crashing or spawning unexpected child processes after connecting to a server.
• Review VNC server logs for repeated or abnormally long HTTP GET requests on port 5800.
• Track use of known vulnerable UltraVNC/tabbed_viewer versions via software inventory.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.