Red Hat has issued an Important security update for tigervnc on RHEL 8 to address multiple vulnerabilities in the underlying xorg-x11-server, including stack buffer overflows and use-after-free flaws that could lead to code execution or information disclosure. The CVSS base scores for these CVEs, such as CVE-2026-50256, are 7.8 (High). Affected systems are those running Red Hat Enterprise Linux versions 7.0, 8.0, and 9.0 with vulnerable x_server (< 21.1.23) or xwayland (< 24.1.12) components, and they should apply the referenced Red Hat erratum package update immediately.
Red Hat Product Errata RHSA-2026:28923 - Security Advisory Issued: 2026-06-24 Updated: 2026-06-24 RHSA-2026:28923 - Security Advisory Overview Updated Packages Synopsis Important: tigervnc security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for tigervnc is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients. Security Fix(es): xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch (CVE-2026-50256) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence() (CVE-2026-50257) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels (CVE-2026-50258) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing (CVE-2026-50259) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in FreeCounter() (CVE-2026-50260) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter() (CVE-2026-50261) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes (CVE-2026-50262) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow() (CVE-2026-50263) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat (CVE-2026-50264) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 8 x86_64 Red Hat Enterprise Linux for IBM z Systems 8 s390x Red Hat Enterprise Linux for Power, little endian 8 ppc64le Red Hat Enterprise Linux for ARM 64 8 aarch64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x Fixes BZ - 2485380 - CVE-2026-50256 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch BZ - 2485382 - CVE-2026-50257 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence() BZ - 2485383 - CVE-2026-50258 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels BZ - 2485384 - CVE-2026-50259 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing BZ - 2485385 - CVE-2026-50260 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in FreeCounter() BZ - 2485386 - CVE-2026-50261 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter() BZ - 2485387 - CVE-2026-50262 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes BZ - 2485388 - CVE-2026-50263 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow() BZ - 2485389 - CVE-2026-50264 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat CVEs CVE-2026-50256 CVE-2026-50257 CVE-2026-50258 CVE-2026-50259 CVE-2026-50260 CVE-2026-50261 CVE-2026-50262 CVE-2026-50263 CVE-2026-50264 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 8 SRPM tigervnc-1.15.0-10.el8_10.src.rpm SHA-256: 9520118ffd9f9b87d26b97f8bb17489dae06d1ced870d3a06b46a7d75e878f7f x86_64 tigervnc-1.15.0-10.el8_10.x86_64.rpm SHA-256: ea5e34748bcb87c96855361cc55bf537413606e6a60f95e078fb916d6a727f8c tigervnc-debuginfo-1.15.0-10.el8_10.x86_64.rpm SHA-256: b244b3993f0eefd52b8444f266a81f8bc49b158584c8a09df2ebf24eed86ef19 tigervnc-debugsource-1.15.0-10.el8_10.x86_64.rpm SHA-256: cc7f546f0f95e93d98e86f191bf1c5a203c71fe124d52703f12392fa78499628 tigervnc-icons-1.15.0-10.el8_10.noarch.rpm SHA-256: c90806a2f20188a95cb28f17225e7ab0e44f746f853678f979b5358941d4a662 tigervnc-license-1.15.0-10.el8_10.noarch.rpm SHA-256: b5d88a9179b2d1cd01223aaffdda4c4f1664d07c40acec634119f8426d9e2a39 tigervnc-selinux-1.15.0-10.el8_10.noarch.rpm SHA-256: 61b52ecdf46ae1352c5d0f7cfadebe19ff7475b8500cb048572b7d9cfbe15732 tigervnc-server-1.15.0-10.el8_10.x86_64.rpm SHA-256: 07c0f26afcbcc94f0c952c6786e0cde461c45469e64f951449b1eb35fc2ab5dd tigervnc-server-debuginfo-1.15.0-10.el8_10.x86_64.rpm SHA-256: fd2ec0c6b973ce57a85d589e044bed213512b54a609761373f5f75db2239e4e5 tigervnc-server-minimal-1.15.0-10.el8_10.x86_64.rpm SHA-256: 17547f946ad26209d83b72b0200913bb1cd0cd04dc1e283b99fe10d146d635b8 tigervnc-server-minimal-debuginfo-1.15.0-10.el8_10.x86_64.rpm SHA-256: 96464ad9f9ed6fca6ac3eed2719a195984a33acbbf3c64e8bc870e06f9c8b0e3 tigervnc-server-module-1.15.0-10.el8_10.x86_64.rpm SHA-256: 916441c9d2d59ad22b07c6d06c7a37bc10e79fafe6bdd20df4fc854c6980b1cd tigervnc-server-module-debuginfo-1.15.0-10.el8_10.x86_64.rpm SHA-256: 93183ff199c245a06e55be3e85085817e10841dca2cfe0320011a2604ae90465 Red Hat Enterprise Linux for IBM z Systems 8 SRPM tigervnc-1.15.0-10.el8_10.src.rpm SHA-256: 9520118ffd9f9b87d26b97f8bb17489dae06d1ced870d3a06b46a7d75e878f7f s390x tigervnc-1.15.0-10.el8_10.s390x.rpm SHA-256: 3f8a1ffd8d5ed272fbd38560d3e076fc9914d6db96fcd41691925fe26a55fa29 tigervnc-debuginfo-1.15.0-10.el8_10.s390x.rpm SHA-256: bbe531fa3fee68113a29b04c15ca25baccf8404b5ae3b49be9929d937d544b20 tigervnc-debugsource-1.15.0-10.el8_10.s390x.rpm SHA-256: 0bb9a4989b86c8d579b57a6c7095155ec936a8bfdb4bfee9d98c54831f488477 tigervnc-icons-1.15.0-10.el8_10.noarch.rpm SHA-256: c90806a2f20188a95cb28f17225e7ab0e44f746f853678f979b5358941d4a662 tigervnc-license-1.15.0-10.el8_10.noarch.rpm SHA-256: b5d88a9179b2d1cd01223aaffdda4c4f1664d07c40acec634119f8426d9e2a39 tigervnc-selinux-1.15.0-10.el8_10.noarch.rpm SHA-256: 61b52ecdf46ae1352c5d0f7cfadebe19ff7475b8500cb048572b7d9cfbe15732 tigervnc-server-1.15.0-10.el8_10.s390x.rpm SHA-256: 5f5ad2500b7d0b1cc56cc30bc2b5a5d09cfa87df8c04b0772a4f859039f27953 tigervnc-server-debuginfo-1.15.0-10.el8_10.s390x.rpm SHA-256: 3910759fe6b36f5d5ef98bf40ae93c4cf7637b86a258ff315a68c270f78c0233 tigervnc-server-minimal-1.15.0-10.el8_10.s390x.rpm SHA-256: ce651beb090b8fb08ecab05a1839679184c349f0e503f3f3813fc6ff011cafd5 tigervnc-server-minimal-debuginfo-1.15.0-10.el8_10.s390x.rpm SHA-256: c27d8fc1678a338a7277236a378db17faf8982301503db426c08db95666c04d7 tigervnc-server-module-1.15.0-10.el8_10.s390x.rpm SHA-256: 372e9cbe39cadc166d3566a3609382de5e161407c82a58852e74f35c0831df1d tigervnc-server-module-debuginfo-1.15.0-10.el8_10.s390x.rpm SHA-256: c58fe4f5b5a185987566243e326ed8b292f90da11a45098032efbe9113c52681 Red Hat Enterprise Linux for Power, little endian 8 SRPM tigervnc-1.15.0-10.el8_10.src.rpm SHA-256: 9520118ffd9f9b87d26b97f8bb17489dae06d1ced870d3a06b46a7d75e878f7f ppc64le tigervnc-1.15.0-10.el8_10.ppc64le.rpm SHA-256: 5e31b14649a5f333cac04a59f510beb70e7e58e9ef29abd968ef77ccf0749bf4 tigervnc-debuginfo-1.15.0-10.el8_10.ppc64le.rpm SHA-256: 4e522bbe1cbcbe682fe4b228539e5d1f0bcc2a242cdf852f90714d00db0a22ee tigervnc-debugsource-1.15.0-10.el8_10.ppc64le.rpm SHA-256: 936b63c630bad86be8b40b5aec3a66fa681afcebf6f736f1a6d11fd90f3f621e tigervnc-icons-1.15.0-10.el8_10.noarch.rpm SHA-256: c90806a2f20188a95cb28f17225e7ab0e44f746f853678f979b5358941d4a662 tigervnc-license-1.15.0-10.el8_10.noarch.rpm SHA-256: b5d88a9179b2d1cd01223aaffdda4c4f1664d07c40acec634119f8426d9e2a39 tigervnc-selinux-1.15.0-10.el8_10.noarch.rpm SHA-256: 61b52ecdf46ae1352c5d0f7cfadebe19ff7475b8500cb048572b7d9cfbe15732 tigervnc-server-1.15.0-10.el8_10.ppc64le.rpm SHA-256: 74c85f8b80dbe5828cfdb983675da9fac408abcd86f4f26309725e7ce945d27c tigervnc-server-debuginfo-1.15.0-10.el8_10.ppc64le.rpm SHA-256: c510f78b3c7b36269d61350e433c2532092c2a0565a243dd65587089805a412d tigervnc-server-minimal-1.15.0-10.el8_10.ppc64le.rpm SHA-256: 98de981606f6dfbee1809ef03f152c39c061d7d856ccf59fc528f1e7338e0260 tigervnc-server-minimal-debuginfo-1.15.0-10.el8_10.ppc64le.rpm SHA-256: 0d6fbf5ee7e623d1146621f53bd0674701b2a935256b303f46e35f18a8d00042 tigervnc-server-module-1.15.0-10.el8_10.ppc64le.rpm SHA-256: a0bad454f829a0412603fa9bef0679dec2d8227169e292d207bb8aca73e504ae tigervnc-server-module-debuginfo-1.15.0-10.el8_10.ppc64le.rpm SHA-256: 857ea3154ca1aeaba391eaa25643c4f4080007770a8754e9ae0976e219714283 Red Hat Enterprise Linux for ARM 64 8 SRPM tigervnc-1.15.0-10.el8_10.src.rpm SHA-256: 9520118ffd9f9b87d26b97f8bb17489dae06d1ced870d3a06b46a7d75e878f7f aarch64 tigervnc-1.15.0-10.el8_10.aarch64.rpm SHA-256: 541af3ae4435c805be7062c79eaefd94b3135507732091ce4ca7a0933cfc4f53 tigervnc-debuginfo-1.15.0-10.