This Red Hat security advisory addresses multiple vulnerabilities in the TigerVNC server for RHEL 7 Extended Lifecycle Support, including high-severity flaws (CVE-2026-33999, CVSS 7.8) such as use-after-free and integer underflow in XKB handling that can lead to denial of service, memory corruption, and information disclosure. The update resolves these issues, which affect the x0vncserver component and underlying X.Org X server libraries. Affected systems are those running TigerVNC on Red Hat Enterprise Linux 7 Extended Lifecycle Support, and administrators should apply the provided patch via the referenced Red Hat solution article.
Red Hat Product Errata RHSA-2026:22456 - Security Advisory Issued: 2026-06-02 Updated: 2026-06-02 RHSA-2026:22456 - Security Advisory Overview Updated Packages Synopsis Important: tigervnc security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for tigervnc is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients. Security Fix(es): xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999) xwayland: xorg: X.Org X server: Information disclosure and denial of service via out-of-bounds read in XKB geometry processing. (CVE-2026-34000) xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001) xorg: xwayland: X.Org X server: Information disclosure or Denial of Service via out-of-bounds read in XKB modifier map handling (CVE-2026-34002) xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003) TigerVNC: x0vncserver: TigerVNC x0vncserver: Information disclosure, data manipulation, and denial of service via incorrect permissions (CVE-2026-34352) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64 Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64 Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le Fixes BZ - 2451106 - CVE-2026-33999 xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling BZ - 2451107 - CVE-2026-34000 xwayland: xorg: X.Org X server: Information disclosure and denial of service via out-of-bounds read in XKB geometry processing. BZ - 2451109 - CVE-2026-34001 xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption BZ - 2451112 - CVE-2026-34002 xorg: xwayland: X.Org X server: Information disclosure or Denial of Service via out-of-bounds read in XKB modifier map handling BZ - 2451113 - CVE-2026-34003 xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access BZ - 2452022 - CVE-2026-34352 TigerVNC: x0vncserver: TigerVNC x0vncserver: Information disclosure, data manipulation, and denial of service via incorrect permissions CVEs CVE-2026-33999 CVE-2026-34000 CVE-2026-34001 CVE-2026-34002 CVE-2026-34003 CVE-2026-34352 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 SRPM tigervnc-1.8.0-36.el7_9.4.src.rpm SHA-256: b4fca0c0c85a5da083c2edce4bae1b5308fe5314cc707cbb63e847a005103405 x86_64 tigervnc-1.8.0-36.el7_9.4.x86_64.rpm SHA-256: 1f9ed15273de62e78fdc09c04cafe38c1d9f47e76f2fe6bea9f9f3b91b328a36 tigervnc-debuginfo-1.8.0-36.el7_9.4.x86_64.rpm SHA-256: 96fc4005a7a2395593c536e3f34d0b4cf48a8685b6ef5f19e41a14707f59a75d tigervnc-debuginfo-1.8.0-36.el7_9.4.x86_64.rpm SHA-256: 96fc4005a7a2395593c536e3f34d0b4cf48a8685b6ef5f19e41a14707f59a75d tigervnc-icons-1.8.0-36.el7_9.4.noarch.rpm SHA-256: ffdfccc3bc4182cf1432f92d754dcec6d48d72c6f0cd425ddc6a8d6c9156bcf9 tigervnc-license-1.8.0-36.el7_9.4.noarch.rpm SHA-256: ea5ef29b3f5323d4c4662c160c367e33bbdfea483a859a79a0a50d60f816d8f1 tigervnc-server-1.8.0-36.el7_9.4.x86_64.rpm SHA-256: acc92c719a750ac2b4135435c850c36a224ae6fb3aa340720631b3008f50fa93 tigervnc-server-applet-1.8.0-36.el7_9.4.noarch.rpm SHA-256: 95ec5c469381121fd37e5fc005c77638396b0dca0632ef6c81b6ed426c6db79a tigervnc-server-minimal-1.8.0-36.el7_9.4.x86_64.rpm SHA-256: 3c87249ed547462cb9f2cd020c7818624c9b2d1c0a6a85fa45fb8c17ab0dfe65 tigervnc-server-module-1.8.0-36.el7_9.4.x86_64.rpm SHA-256: c233ad6aa4a88e997d889fcd4b04a5ee174b58895068dcd83921a311774ddd6c Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 SRPM tigervnc-1.8.0-36.el7_9.4.src.rpm SHA-256: b4fca0c0c85a5da083c2edce4bae1b5308fe5314cc707cbb63e847a005103405 s390x tigervnc-1.8.0-36.el7_9.4.s390x.rpm SHA-256: c804e2a57bcfc47384f73a1f1ac9f64cd18e582e2a860239b694091299f3b6e5 tigervnc-debuginfo-1.8.0-36.el7_9.4.s390x.rpm SHA-256: 5ff9206a845682014627623a3f743a81f9ebd66c8080bfe826dc4c0ee2e9c16a tigervnc-icons-1.8.0-36.el7_9.4.noarch.rpm SHA-256: ffdfccc3bc4182cf1432f92d754dcec6d48d72c6f0cd425ddc6a8d6c9156bcf9 tigervnc-license-1.8.0-36.el7_9.4.noarch.rpm SHA-256: ea5ef29b3f5323d4c4662c160c367e33bbdfea483a859a79a0a50d60f816d8f1 tigervnc-server-1.8.0-36.el7_9.4.s390x.rpm SHA-256: 9bcb58b200096256907ccad0e4e4b049de5cb13e7d30a201b309e20ceae41b07 tigervnc-server-applet-1.8.0-36.el7_9.4.noarch.rpm SHA-256: 95ec5c469381121fd37e5fc005c77638396b0dca0632ef6c81b6ed426c6db79a tigervnc-server-minimal-1.8.0-36.el7_9.4.s390x.rpm SHA-256: 7407eea74df80ddfc9220f56851045bc034ce1ae4cea9063b37cd0ab2e5cb068 Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 SRPM tigervnc-1.8.0-36.el7_9.4.src.rpm SHA-256: b4fca0c0c85a5da083c2edce4bae1b5308fe5314cc707cbb63e847a005103405 ppc64 tigervnc-1.8.0-36.el7_9.4.ppc64.rpm SHA-256: d000177e09073b1c310dcef4fab56dd5727586229fec6270829482181bc249e6 tigervnc-debuginfo-1.8.0-36.el7_9.4.ppc64.rpm SHA-256: 8dddc8730b3dac412205dc240f640dd8cade25d79b2b43e559d53fa1615e25b3 tigervnc-debuginfo-1.8.0-36.el7_9.4.ppc64.rpm SHA-256: 8dddc8730b3dac412205dc240f640dd8cade25d79b2b43e559d53fa1615e25b3 tigervnc-icons-1.8.0-36.el7_9.4.noarch.rpm SHA-256: ffdfccc3bc4182cf1432f92d754dcec6d48d72c6f0cd425ddc6a8d6c9156bcf9 tigervnc-license-1.8.0-36.el7_9.4.noarch.rpm SHA-256: ea5ef29b3f5323d4c4662c160c367e33bbdfea483a859a79a0a50d60f816d8f1 tigervnc-server-1.8.0-36.el7_9.4.ppc64.rpm SHA-256: b8e49fcae82a04c79e627f30886845a3e86afe115418ea1c2433d21104879a93 tigervnc-server-applet-1.8.0-36.el7_9.4.noarch.rpm SHA-256: 95ec5c469381121fd37e5fc005c77638396b0dca0632ef6c81b6ed426c6db79a tigervnc-server-minimal-1.8.0-36.el7_9.4.ppc64.rpm SHA-256: 29dea90bee297b66dbb78e3e30b1d1b3263e59487ab2ae2c8a1788e8f6c77ffa tigervnc-server-module-1.8.0-36.el7_9.4.ppc64.rpm SHA-256: 6851fb9de902fcede480fec95b57a6ee1b06c402fdb5a525546e743c22231c10 Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 SRPM tigervnc-1.8.0-36.el7_9.4.src.rpm SHA-256: b4fca0c0c85a5da083c2edce4bae1b5308fe5314cc707cbb63e847a005103405 ppc64le tigervnc-1.8.0-36.el7_9.4.ppc64le.rpm SHA-256: c22837685839615faf9c2b772bf80cdaa7ad8891f6aa03617da64e720dec8239 tigervnc-debuginfo-1.8.0-36.el7_9.4.ppc64le.rpm SHA-256: a0d3b3b469a82368e34f94caa107f212f4340c79c65d28aca61c56786c5bb041 tigervnc-debuginfo-1.8.0-36.el7_9.4.ppc64le.rpm SHA-256: a0d3b3b469a82368e34f94caa107f212f4340c79c65d28aca61c56786c5bb041 tigervnc-icons-1.8.0-36.el7_9.4.noarch.rpm SHA-256: ffdfccc3bc4182cf1432f92d754dcec6d48d72c6f0cd425ddc6a8d6c9156bcf9 tigervnc-license-1.8.0-36.el7_9.4.noarch.rpm SHA-256: ea5ef29b3f5323d4c4662c160c367e33bbdfea483a859a79a0a50d60f816d8f1 tigervnc-server-1.8.0-36.el7_9.4.ppc64le.rpm SHA-256: e8019d122f76ac070b4d3622805cb4896fe648977fe492dac02d30d2b46c50f6 tigervnc-server-applet-1.8.0-36.el7_9.4.noarch.rpm SHA-256: 95ec5c469381121fd37e5fc005c77638396b0dca0632ef6c81b6ed426c6db79a tigervnc-server-minimal-1.8.0-36.el7_9.4.ppc64le.rpm SHA-256: de28e714f11bf689a3a748c7878ba145459778606be7b220f998146f7ff8776b tigervnc-server-module-1.8.0-36.el7_9.4.ppc64le.rpm SHA-256: a4917d52a3c4f718f676c49d743288a2e39dc6776851e15bccfa7219cb5d3b8e The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .