Critical Security Update for TigerVNC: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:19342: Important: tigervnc security update. Affects tigervnc versions < 1.15.0-7.el9_8.1. Fixed in 1.15.0-7.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TigerVNC is a popular suite of Virtual Network Computing (VNC) servers and clients that enables users to access and control a computing desktop environment remotely. It supports various machine architectures and is widely used for remote desktop access. However, recent vulnerabilities have been identified that could compromise the security of systems running TigerVNC, necessitating immediate attention and remediation.
Vulnerability Detail
The vulnerabilities in TigerVNC stem from several issues within the X.Org X server and TigerVNC components. These include an integer underflow leading to denial of service (CVE-2026-33999), out-of-bounds reads causing information disclosure and denial of service (CVE-2026-34000), a use-after-free vulnerability that can lead to server crashes and potential memory corruption (CVE-2026-34001), and incorrect permissions in the x0vncserver that allow for information disclosure and data manipulation (CVE-2026-34352). These vulnerabilities could allow attackers to disrupt service, access sensitive information, or manipulate data.
How To Fix
Minimum fixed version
1.15.0-7.el9_8.1
This is the first release that contains the fix.
sudo dnf update tigervncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you may restrict access to the VNC server by configuring firewall rules to limit connections only to trusted IP addresses. Additionally, consider disabling any unnecessary services that may expose the VNC server to potential attacks.
Conclusion
The identified vulnerabilities in TigerVNC pose serious security risks that require immediate action. By updating to the latest patched version, users can protect their systems from potential attacks. Additionally, implementing workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for tigervnc →
FAQ
TigerVNC is a remote display system that allows users to view and interact with a desktop environment from anywhere over the internet.
The vulnerabilities can lead to denial of service, information disclosure, and potential data manipulation, posing significant risks to system integrity and confidentiality.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Yes, you can implement firewall rules to restrict access to the VNC server and disable unnecessary services to reduce exposure.
Detailed information about the vulnerabilities can be found on the CVE pages linked in the advisory, as well as through security bulletins from your distribution.
Related vulnerabilities
Recent vulnerabilities recorded for tigervnc.
