UltraVNC 1.6.4.0 contains an uncontrolled search path vulnerability in the Windows Service component that could allow a local attacker to execute unauthorized code.

This vulnerability is an uncontrolled search path flaw (CWE-427) located in the cryptbase.dll library of the Windows Service. The attack requires local access and elevated complexity, as the attacker must be able to manipulate the search path environment to trigger the issue.

The exploitation of this vulnerability could lead to total compromise of the affected system, as the flaw resides within a service component. Given the CVSS score of 7.0, this represents a high-risk security gap that could result in unauthorized data access, privilege escalation, or service disruption. Organizations relying on UltraVNC for remote management should treat this as a significant threat to internal infrastructure integrity.

Immediate Action: Since no official patch is currently available, administrators should restrict local access to the server and monitor the UltraVNC service for suspicious file modification or binary execution.

Proactive Monitoring: Review system logs for unusual process creation or unauthorized changes to Windows search path environment variables.

Compensating Controls: Implement strict file system permissions to prevent unauthorized users from placing malicious DLL files in locations that the UltraVNC service might reach during its search path resolution.

Public Exploit Available: No (Exploit_available: false).

Although there is no patch from the vendor at this time, the potential for total system impact necessitates proactive defensive measures. Security teams should audit their UltraVNC deployments and ensure that local system access is strictly controlled to mitigate the risk posed by this search path vulnerability.