CVE-2019-8274

9.8 criticalEPSS 8.3%

UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer offer handler, which can potentially in result code execution. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1212.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 8.3% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
CWEs: CWE-787, CWE-122
Published: 2019-03-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

siemens:sinumerik_access_mymachine\/p2p
siemens:sinumerik_pcu_base_win10_software\/ipc
siemens:sinumerik_pcu_base_win7_software\/ipc
uvnc:ultravnc

References

https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf
https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-021-ultravnc-heap-based-buffer-overflow/
https://www.us-cert.gov/ics/advisories/icsa-20-161-06
https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf
https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-021-ultravnc-heap-based-buffer-overflow/

Check your stack JSON