Critical Security Update for TigerVNC: Addressing Multiple Use-After-Free Vulnerabilities
Summary
ALSA-2025:19909: Important: tigervnc security update. Affects tigervnc versions < 1.15.0-8.el8_10. Fixed in 1.15.0-8.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TigerVNC is a suite of Virtual Network Computing (VNC) servers and clients that allows users to remotely access and control a computing desktop environment from various devices over the Internet. It is widely used for remote desktop sharing and management across different operating systems. The recent vulnerabilities identified in TigerVNC could potentially allow unauthorized access or control over systems running affected versions, highlighting the importance of maintaining updated software.
Vulnerability Detail
The vulnerabilities in TigerVNC stem from use-after-free errors in the XPresentNotify structure and Xkb client resource removal, as well as a value overflow in the XkbSetCompatMap function. These issues can lead to memory corruption, potentially allowing attackers to execute arbitrary code or crash the application. The vulnerabilities are tracked under CVE-2025-62229, CVE-2025-62230, and CVE-2025-62231, which indicate serious security risks that need immediate attention.
How To Fix
Minimum fixed version
1.15.0-8.el8_10
This is the first release that contains the fix.
sudo dnf update tigervncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for these vulnerabilities. The best course of action is to apply the security updates as soon as they are available.
Conclusion
The vulnerabilities identified in TigerVNC pose significant security risks that could allow unauthorized access to systems. It is imperative for users to update their installations to the latest patched version to ensure their systems remain secure. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in real-time.
See every vulnerability recorded for tigervnc →
FAQ
TigerVNC is a remote display system that allows users to view and control a desktop environment from anywhere over the Internet.
The vulnerabilities include use-after-free errors and a value overflow, which can lead to memory corruption and potential unauthorized access.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
While there are no specific workarounds, it is crucial to prioritize updating to the patched version as soon as possible to mitigate risks.
Detailed information about the vulnerabilities can be found on the CVE pages for CVE-2025-62229, CVE-2025-62230, and CVE-2025-62231.
Related vulnerabilities
Recent vulnerabilities recorded for tigervnc.
