This Red Hat security advisory addresses multiple high-severity vulnerabilities (CVSS 7.8) in TigerVNC affecting Red Hat Enterprise Linux 8. The flaws include an integer underflow, a use-after-free, an out-of-bounds memory access in X.Org X server components, and incorrect permissions in TigerVNC's x0vncserver, which can lead to denial of service, information disclosure, or potential memory corruption. The update provides patched packages to remediate these issues; specific fixed version numbers are not provided in the source material.
Red Hat Product Errata RHSA-2026:13414 - Security Advisory Issued: 2026-05-04 Updated: 2026-05-04 RHSA-2026:13414 - Security Advisory Overview Updated Packages Synopsis Important: tigervnc security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for tigervnc is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients. Security Fix(es): xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999) xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001) xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003) TigerVNC: x0vncserver: TigerVNC x0vncserver: Information disclosure, data manipulation, and denial of service via incorrect permissions (CVE-2026-34352) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 8 x86_64 Red Hat Enterprise Linux for IBM z Systems 8 s390x Red Hat Enterprise Linux for Power, little endian 8 ppc64le Red Hat Enterprise Linux for ARM 64 8 aarch64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x Fixes BZ - 2451106 - CVE-2026-33999 xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling BZ - 2451109 - CVE-2026-34001 xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption BZ - 2451113 - CVE-2026-34003 xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access BZ - 2452022 - CVE-2026-34352 TigerVNC: x0vncserver: TigerVNC x0vncserver: Information disclosure, data manipulation, and denial of service via incorrect permissions CVEs CVE-2026-33999 CVE-2026-34001 CVE-2026-34003 CVE-2026-34352 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 8 SRPM tigervnc-1.15.0-9.el8_10.src.rpm SHA-256: 7b7c1b8daaeb76656b057fcf0efbd3c7499631734a8ec3866a7285df9821969b x86_64 tigervnc-1.15.0-9.el8_10.x86_64.rpm SHA-256: 913f099476605967e770cb4856edd5c15a1f127c7ef97a1fe78487b02902878c tigervnc-debuginfo-1.15.0-9.el8_10.x86_64.rpm SHA-256: bd738b0e0c080aa7cda8bb7095577628fc528c3b29396a98ae6c0c8aff048573 tigervnc-debugsource-1.15.0-9.el8_10.x86_64.rpm SHA-256: 28e6b1ec47cad4263fce8835fd11f30d6d4afbc97067159d85c5c8685e0579ce tigervnc-icons-1.15.0-9.el8_10.noarch.rpm SHA-256: 535029c67d12e7ddc40f748277f622f41554d9e8df118e6aedd8f718b2ce1cbf tigervnc-license-1.15.0-9.el8_10.noarch.rpm SHA-256: 5287984006ebaba6a00df3bbe720df087b92585420384d659ee423500048534e tigervnc-selinux-1.15.0-9.el8_10.noarch.rpm SHA-256: 5235e9ade3d4c9d36291d1a3b53afdd14693127dbdcc93bbf7b8fe780012b53e tigervnc-server-1.15.0-9.el8_10.x86_64.rpm SHA-256: 84b2d9df0a138ab7dcfdc4b14c7362d831c4237901a84f81fcd4251bfd37a4d3 tigervnc-server-debuginfo-1.15.0-9.el8_10.x86_64.rpm SHA-256: 2095b1379d46d3bb76e48f13fca22b8352381a81547ca9fa47b65be7f141bec2 tigervnc-server-minimal-1.15.0-9.el8_10.x86_64.rpm SHA-256: 848ec8deb41f570321904855406431259eecc48c223ed5d4c3d0134b101e85ab tigervnc-server-minimal-debuginfo-1.15.0-9.el8_10.x86_64.rpm SHA-256: b9a61d99cc5db4b38ab94958315aa80f5c22ce6778c184c2b43f9babd0c6c0a6 tigervnc-server-module-1.15.0-9.el8_10.x86_64.rpm SHA-256: a0e2c12e3c713c6a4bb04ea22483921785430572a2436862ab6e8ce2dc8a64f9 tigervnc-server-module-debuginfo-1.15.0-9.el8_10.x86_64.rpm SHA-256: 74030c567e62e899404ebf183548886c9a5cba432eb70482886357e3f38b5009 Red Hat Enterprise Linux for IBM z Systems 8 SRPM tigervnc-1.15.0-9.el8_10.src.rpm SHA-256: 7b7c1b8daaeb76656b057fcf0efbd3c7499631734a8ec3866a7285df9821969b s390x tigervnc-1.15.0-9.el8_10.s390x.rpm SHA-256: fb47fd1cf9a2da230e8301a269234fa2b564d03114f97d07289769b6975d9557 tigervnc-debuginfo-1.15.0-9.el8_10.s390x.rpm SHA-256: c78254606b11263e2512070553752a6f51357010f78a2f09e7af75d58e986a42 tigervnc-debugsource-1.15.0-9.el8_10.s390x.rpm SHA-256: 73b47278c79bb9023083089694a2ccb604ce37d2df73ae3addcf8af5d38c1c91 tigervnc-icons-1.15.0-9.el8_10.noarch.rpm SHA-256: 535029c67d12e7ddc40f748277f622f41554d9e8df118e6aedd8f718b2ce1cbf tigervnc-license-1.15.0-9.el8_10.noarch.rpm SHA-256: 5287984006ebaba6a00df3bbe720df087b92585420384d659ee423500048534e tigervnc-selinux-1.15.0-9.el8_10.noarch.rpm SHA-256: 5235e9ade3d4c9d36291d1a3b53afdd14693127dbdcc93bbf7b8fe780012b53e tigervnc-server-1.15.0-9.el8_10.s390x.rpm SHA-256: 364c56697f138ecfeaaba173df83554732b9054f8344438bc448ed6d7a29cede tigervnc-server-debuginfo-1.15.0-9.el8_10.s390x.rpm SHA-256: b4ba2d24cfe98791bcca12fa5b0ba458af35176b2c8ab168be0899286d0bb81c tigervnc-server-minimal-1.15.0-9.el8_10.s390x.rpm SHA-256: 3e5b05ee094f23fdbffa7f7cea13b8384d625976aa2a8f0b713ac045ed20605b tigervnc-server-minimal-debuginfo-1.15.0-9.el8_10.s390x.rpm SHA-256: e5ac5ff9907ae2a947930250882b3ff05f9f4ffc0be38d6386a0d20f64de683a tigervnc-server-module-1.15.0-9.el8_10.s390x.rpm SHA-256: 3a4e0e9667b0ac8d97b7953001aeec1b3ac21cf8e1344681d158082322bc613f tigervnc-server-module-debuginfo-1.15.0-9.el8_10.s390x.rpm SHA-256: 89296aa71ffd0e3bf6ab7eea4fbc9775d6b42342e707cffa575a8faad7daa4ba Red Hat Enterprise Linux for Power, little endian 8 SRPM tigervnc-1.15.0-9.el8_10.src.rpm SHA-256: 7b7c1b8daaeb76656b057fcf0efbd3c7499631734a8ec3866a7285df9821969b ppc64le tigervnc-1.15.0-9.el8_10.ppc64le.rpm SHA-256: 3e26698684f61e9e13198b24110b71c0c5cee356e509abdc4ba150853a579747 tigervnc-debuginfo-1.15.0-9.el8_10.ppc64le.rpm SHA-256: 26a6bec92fce6326ec92b67b23d8c720eb83cab1b47e23493a864ec395cfde2f tigervnc-debugsource-1.15.0-9.el8_10.ppc64le.rpm SHA-256: 8324c1d00da710baed04f693ea56885a6e2519e81e8d5cce6a3a56b420e02c77 tigervnc-icons-1.15.0-9.el8_10.noarch.rpm SHA-256: 535029c67d12e7ddc40f748277f622f41554d9e8df118e6aedd8f718b2ce1cbf tigervnc-license-1.15.0-9.el8_10.noarch.rpm SHA-256: 5287984006ebaba6a00df3bbe720df087b92585420384d659ee423500048534e tigervnc-selinux-1.15.0-9.el8_10.noarch.rpm SHA-256: 5235e9ade3d4c9d36291d1a3b53afdd14693127dbdcc93bbf7b8fe780012b53e tigervnc-server-1.15.0-9.el8_10.ppc64le.rpm SHA-256: 753f2c34a82d6f18f2333dbf6aaa6650fc1766d008911c4596b9a48877f708ad tigervnc-server-debuginfo-1.15.0-9.el8_10.ppc64le.rpm SHA-256: 452d59cd94981a948436266c020488e009846f4bb7133059bc7ba6449667e858 tigervnc-server-minimal-1.15.0-9.el8_10.ppc64le.rpm SHA-256: 22e27fd97c68d5bb261eda9f6d9f88763e8a572a02a6229ef0e2cd93a62a2323 tigervnc-server-minimal-debuginfo-1.15.0-9.el8_10.ppc64le.rpm SHA-256: 040da4c952aff9426b9712bb9d2cc856b888264a563204fc70277cf5b26ca274 tigervnc-server-module-1.15.0-9.el8_10.ppc64le.rpm SHA-256: cd556db455eeb363f39de7c015fdb70972f72a1eec6ab7e2272710c34386cd03 tigervnc-server-module-debuginfo-1.15.0-9.el8_10.ppc64le.rpm SHA-256: 24f79cd224a6a9bc5a188401ee90a364cb4e2c51c915ea9c24763662b25dcc3e Red Hat Enterprise Linux for ARM 64 8 SRPM tigervnc-1.15.0-9.el8_10.src.rpm SHA-256: 7b7c1b8daaeb76656b057fcf0efbd3c7499631734a8ec3866a7285df9821969b aarch64 tigervnc-1.15.0-9.el8_10.aarch64.rpm SHA-256: 05901a44bb869b81225db1d0bdacb965756023644a8e07a076f07f052441deb1 tigervnc-debuginfo-1.15.0-9.el8_10.aarch64.rpm SHA-256: 5fc7ba821a2b803e9c411d982dd2500be53bb394363b7cdc14b394c208de41c6 tigervnc-debugsource-1.15.0-9.el8_10.aarch64.rpm SHA-256: f0d0d103d6525fa065af6472a4e903f0a4d963ef28ab3c425d8a6572bd825806 tigervnc-icons-1.15.0-9.el8_10.noarch.rpm SHA-256: 535029c67d12e7ddc40f748277f622f41554d9e8df118e6aedd8f718b2ce1cbf tigervnc-license-1.15.0-9.el8_10.noarch.rpm SHA-256: 5287984006ebaba6a00df3bbe720df087b92585420384d659ee423500048534e tigervnc-selinux-1.15.0-9.el8_10.noarch.rpm SHA-256: 5235e9ade3d4c9d36291d1a3b53afdd14693127dbdcc93bbf7b8fe780012b53e tigervnc-server-1.15.0-9.el8_10.aarch64.rpm SHA-256: 26cf0c6a1e9626bd5370a929e7ead093b309e843b50e224703ffaea49b2d65dd tigervnc-server-debuginfo-1.15.0-9.el8_10.aarch64.rpm SHA-256: 983c731d6b6cd507db78469f7dfdff24fef82591234e820e36057d7c46db041b tigervnc-server-minimal-1.15.0-9.el8_10.aarch64.rpm SHA-256: 487915ed3db1f6fca616f33160e95688eed36b6650d36f3709ca2c2d3adf5c88 tigervnc-server-minimal-debuginfo-1.15.0-9.el8_10.aarch64.rpm SHA-256: a04e8aa716d3573b86ad8edfa7a167f9e911e1d4013ed78134b4764bdf8c62de tigervnc-server-module-1.15.0-9.el8_10.aarch64.rpm SHA-256: f5b18bfb3c6b4941c8f759bb4979113b02de218f3f0c1428cbcf098f26faf2af tigervnc-server-module-debuginfo-1.15.0-9.el8_10.aarch64.rpm SHA-256: 29c9817d5bb0b3d46cf9e8de5832fdaf3557f931137306e68975bdec97978751 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 SRPM tigervnc-1.15.0-9.el8_10.src.rpm SHA-256: 7b7c1b8daaeb76656b057fcf0efbd3c7499631734a8ec3866a7285df9821969b x86_64 tigervnc-1.15.0-9.el8_10