CVE-2026-3787

HIGH 7.0

UltraVNC Windows Service cryptbase.dll uncontrolled search path

CVSS Score

7.0

EPSS Score

0.0%

EPSS Percentile

0th

A weakness has been identified in UltraVNC 1.6.4.0 on Windows. This affects an unknown function in the library cryptbase.dll of the component Windows Service. This manipulation causes uncontrolled search path. The attack requires local access. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-427 CWE-426
Vendor	n/a
Product	ultravnc
Published	Mar 8, 2026
Last Updated	Mar 10, 2026

Stay Ahead of the Next One

Get instant alerts for n/a ultravnc

Be the first to know when new high vulnerabilities affecting n/a ultravnc are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

n/a / UltraVNC

1.6.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/?id.349754 vuldb.com: https://vuldb.com/?ctiid.349754 vuldb.com: https://vuldb.com/?submit.767257 drive.google.com: https://drive.google.com/file/d/14ixv_1i4D2VrZWyl4RKsvFcN1AMF_qNx/view

Credits

🔍 haehanse (VulDB User) VulDB