TigerVNC vulnerabilities
We track 12 vulnerabilities in TigerVNC products. 12 are rated high or critical, and none are known to be exploited. The most recent was published on March 26, 2026.
Latest TigerVNC vulnerabilities
- 9.8 Critical severity
TigerVNC: Incorrect Permission Assignment for Critical Resource
In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an application crash, because of incorrect permissions.
- 7.8 High severity
Red Hat Enterprise Linux 10: Use After Free
A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the trigger values as requested, and eventually, SyncInitTrigger() is called. If one of the changes trigger
- 7.8 High severity
Red Hat Enterprise Linux 10: Use After Free
A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying the events will cause a use-after-free.
- 7.8 High severity
Red Hat Enterprise Linux 10: Access of Uninitialized Pointer
An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree m
- 7.8 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Write
An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the las
- 7.8 High severity
Red Hat Enterprise Linux 10: Improper Restriction of Operations within the Bounds of a Memory Buffer
A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey() is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, this
- 7.8 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Write
A heap overflow flaw was found in X.Org and Xwayland. The computation of the length in XkbSizeKeySyms() differs from what is written in XkbWriteKeySyms(), which may lead to a heap-based buffer overflow.
- 7.8 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Write
A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the
- 7.8 High severity
Red Hat Enterprise Linux 10: Use After Free
A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free.
- 7.8 High severity
Red Hat Enterprise Linux 7: Out-of-bounds Write
A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context.
- 7.5 High severity
Red Hat Enterprise Linux 6 Extended Lifecycle…: Integer Overflow or Wraparound
A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive information.
- 7.8 High severity
Red Hat Enterprise Linux 6 Extended Lifecycle…: Out-of-bounds Read
A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or possible remote code execution in cases where X