An uncontrolled search path vulnerability in UltraVNC versions up to 1.6.4.0 may allow a local attacker to execute arbitrary code with elevated privileges.

This vulnerability is caused by an uncontrolled search path (CWE-427) in the version.dll library of the UltraVNC Service component. Successful exploitation requires an attacker to have local access to the system.

The exploitation of this flaw could allow a local user to compromise the integrity and availability of the affected system by executing code with the permissions of the UltraVNC service. Given the CVSS score of 7.0, this represents a high severity risk that could lead to full system compromise if the service runs with administrative or system-level privileges.

Immediate Action: As no official patch is currently available, organizations should restrict local access to the affected system and monitor the file system for unauthorized library placements.

Proactive Monitoring: Security teams should monitor system logs for suspicious process execution patterns or modifications to the directory where UltraVNC is installed.

Compensating Controls: Ensure that the service account running UltraVNC follows the principle of least privilege to limit the potential damage should an attacker successfully trigger the search path flaw.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided in the vulnerability references.

While this vulnerability requires local access, the potential for total system impact necessitates immediate attention. Until a vendor patch is released, prioritize restricting local user permissions on systems running the UltraVNC service. Organizations should maintain a high state of vigilance and prepare to deploy updates immediately upon the release of a fix by the vendor.