Critical Security Update for TigerVNC: Addressing Multiple Use-After-Free Vulnerabilities
Summary
ALSA-2025:19489: Important: tigervnc security update. Affects tigervnc versions < 1.14.1-9.el9_6. Fixed in 1.14.1-9.el9_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TigerVNC is a suite of Virtual Network Computing (VNC) servers and clients that enables users to remotely access and control desktop environments over the internet. It supports various machine architectures and is widely used for remote desktop sharing. The recent vulnerabilities identified in TigerVNC could potentially allow unauthorized access or manipulation of the remote desktop environment, posing significant security risks to users.
Vulnerability Detail
The vulnerabilities in TigerVNC stem from use-after-free issues in the XPresentNotify structure and Xkb client resource removal, as well as a value overflow in the XkbSetCompatMap() function. These vulnerabilities can lead to memory corruption, which may allow an attacker to execute arbitrary code or crash the application, compromising the integrity and availability of the remote desktop service.
How To Fix
Minimum fixed version
1.14.1-9.el9_6
This is the first release that contains the fix.
sudo dnf update tigervncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to the VNC server by configuring firewall rules to restrict incoming connections. Additionally, users should avoid using the vulnerable features until the update is applied.
Conclusion
The identified vulnerabilities in TigerVNC pose serious security risks that can be mitigated through timely updates. Users are strongly encouraged to apply the available patches to protect their systems from potential exploitation.
See every vulnerability recorded for tigervnc →
FAQ
The vulnerabilities include use-after-free issues in XPresentNotify and Xkb client resource removal, as well as a value overflow in XkbSetCompatMap().
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
These vulnerabilities could allow attackers to execute arbitrary code, leading to unauthorized access or service disruption.
Yes, a patch is available in version 1.14.1-9.el9_6 of the affected packages. Users should update to this version.
As a temporary measure, restrict access to the VNC server using firewall rules and avoid using the vulnerable features until the update is applied.
Related vulnerabilities
Recent vulnerabilities recorded for tigervnc.
