CVE-2026-3787CWE-426CWE-427

UltraVNC Windows Service cryptbase.dll uncontrolled search path

High · published March 8, 2026

CVSS v4.0
7.3
EPSS
0%
Percentile
7.5
In the wild
Unconfirmed
What it is

A weakness has been identified in UltraVNC 1.6.4.0 on Windows. This affects an unknown function in the library cryptbase.dll of the component Windows Service. This manipulation causes uncontrolled search path. The attack requires local access. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v4.0
7.3 · HIGH
Vector
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.00184 · 7.5th percentile
Weaknesses
CWE-426 · Untrusted Search Path; CWE-427 · Uncontrolled Search Path Element
Published
2026-03-08T23:02Z
EPSS history
Timeline
  • 08 MAR 23:02Z
    UltraVNC Windows Service cryptbase.dll uncontrolled search path
    cvelistv5