Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.9

UltraVNC Launcher can crash from long input

CVE-2019-25601 · published 7 months ago
Summary

The UltraVNC Launcher (version 1.2.2.4) can be forced to stop working if a user enters an unusually long string in the Properties dialog. This causes the program to shut down, preventing remote desktop connections. To avoid the issue, limit the length of text entered or apply any available update that corrects the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
uvnc ultravnc launcher 1.2.2.4
Original advisory text
UltraVNC Launcher 1.2.2.4 Denial of Service Buffer Overflow
UltraVNC Launcher 1.2.2.4 contains a buffer overflow vulnerability in the Path vncviewer.exe property field that allows local attackers to crash the application by supplying an excessively long string. Attackers can input a 300-byte payload of repeated characters through the Properties dialog to trigger a denial of service condition.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-787Out-of-bounds Write
Timeline
Published22 Mar 2026
Updated4 Nov 2026
First seen22 Mar 2026
Sources
CVE-2019-25601 · NVD
CVE-2019-25601 · MITRE
Track software like this
Free during beta