UltraVNC Launcher Buffer Overflow Vulnerability Leading to Denial-of-Service

A buffer overflow vulnerability has been identified in UltraVNC Launcher version 1.2.2.4. The issue arises in the 'Path vncviewer.exe' property field, where local attackers can cause the application to crash by entering an excessively long string. This is achieved by inputting a 300-byte payload of repeated characters through the Properties dialog, which triggers a denial-of-service condition.

Impact

Exploitation of this vulnerability causes the application to crash, leading to a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by opening the UltraVNC Launcher and navigating to the Properties dialog. In the 'Path vncviewer.exe' field, paste a 300-byte payload of repeated characters. After clicking 'OK', the application will crash.