This advisory addresses nine vulnerabilities (CVE-2026-50256 through CVE-2026-50264) in the xorg-x11-server component used by TigerVNC, including multiple stack buffer overflows, use-after-free flaws, and out-of-bounds read/write issues that could lead to remote code execution or information disclosure. The CVSS base score for several listed CVEs is 7.8 (High). Affected systems include Red Hat Enterprise Linux 7.0, 8.0, and 9.0, and the underlying x.org X Server and Xwayland components require patching to versions 21.1.23 and 24.1.12, respectively.
Red Hat Product Errata RHSA-2026:29844 - Security Advisory Issued: 2026-06-25 Updated: 2026-06-25 RHSA-2026:29844 - Security Advisory Overview Updated Packages Synopsis Important: tigervnc security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for tigervnc is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients. Security Fix(es): xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch (CVE-2026-50256) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence() (CVE-2026-50257) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels (CVE-2026-50258) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing (CVE-2026-50259) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in FreeCounter() (CVE-2026-50260) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter() (CVE-2026-50261) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes (CVE-2026-50262) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow() (CVE-2026-50263) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat (CVE-2026-50264) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 9 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64 Red Hat Enterprise Linux for IBM z Systems 9 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x Red Hat Enterprise Linux for Power, little endian 9 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le Red Hat Enterprise Linux for ARM 64 9 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x Fixes BZ - 2485380 - CVE-2026-50256 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch BZ - 2485382 - CVE-2026-50257 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence() BZ - 2485383 - CVE-2026-50258 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels BZ - 2485384 - CVE-2026-50259 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing BZ - 2485385 - CVE-2026-50260 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in FreeCounter() BZ - 2485386 - CVE-2026-50261 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter() BZ - 2485387 - CVE-2026-50262 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes BZ - 2485388 - CVE-2026-50263 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow() BZ - 2485389 - CVE-2026-50264 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat CVEs CVE-2026-50256 CVE-2026-50257 CVE-2026-50258 CVE-2026-50259 CVE-2026-50260 CVE-2026-50261 CVE-2026-50262 CVE-2026-50263 CVE-2026-50264 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 9 SRPM tigervnc-1.15.0-7.el9_8.2.src.rpm SHA-256: de19e3ca6a41d871ed72046efab089753c498c991bb7961d8ed430937def7baa x86_64 tigervnc-1.15.0-7.el9_8.2.x86_64.rpm SHA-256: 57b13329f489fde56421fbde288003ca7dc53de7eab4cfa015a3c3d4694f7235 tigervnc-debuginfo-1.15.0-7.el9_8.2.x86_64.rpm SHA-256: c77c61eb2312bc240a5287d853c1b7f4abca4bd0302dc58cef4b50d9cc208079 tigervnc-debugsource-1.15.0-7.el9_8.2.x86_64.rpm SHA-256: 2399057acdc13ca67810d55119fe8783a1b37fe09cd7fc3288944eddca67e54d tigervnc-icons-1.15.0-7.el9_8.2.noarch.rpm SHA-256: 24f53478f97442aa8473daab1dc8e2265406c40c5a63a03b0285b0eae0daec5b tigervnc-license-1.15.0-7.el9_8.2.noarch.rpm SHA-256: f2d4fc9d0ca9d4ea0a92ba7bbae24e6775e32ffc778c24442c89382f34f289a2 tigervnc-selinux-1.15.0-7.el9_8.2.noarch.rpm SHA-256: 512d60a74f00757f199d792104553546fc72f4905fa6ee54d897b16f558efdf5 tigervnc-server-1.15.0-7.el9_8.2.x86_64.rpm SHA-256: d0143d34b2e3451db2def98086da582e34c0bd78951728904ab039d08651f3f8 tigervnc-server-debuginfo-1.15.0-7.el9_8.2.x86_64.rpm SHA-256: ccde871357b85e1c4cb5eb0b443598d6ce6efd48821cc0aea90cc66630a3f7a8 tigervnc-server-minimal-1.15.0-7.el9_8.2.x86_64.rpm SHA-256: 6c3be599756dfdd01d8f28f3e71c963bb2993836ebb8dcf4e9ecdff3b65f609d tigervnc-server-minimal-debuginfo-1.15.0-7.el9_8.2.x86_64.rpm SHA-256: 9bfd239accc5f50b5c5988fd18dc9944b4324c124f7650032682052e345ef445 tigervnc-server-module-1.15.0-7.el9_8.2.x86_64.rpm SHA-256: dbf611576ee5525eb0feb2c885eebad125978bf344207bc4ace4757725538d5e tigervnc-server-module-debuginfo-1.15.0-7.el9_8.2.x86_64.rpm SHA-256: 5e9d8b5112a0957de1555f745b809a31635fda8ebc90ac6630d6800dbeb5494b Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 SRPM tigervnc-1.15.0-7.el9_8.2.src.rpm SHA-256: de19e3ca6a41d871ed72046efab089753c498c991bb7961d8ed430937def7baa x86_64 tigervnc-1.15.0-7.el9_8.2.x86_64.rpm SHA-256: 57b13329f489fde56421fbde288003ca7dc53de7eab4cfa015a3c3d4694f7235 tigervnc-debuginfo-1.15.0-7.el9_8.2.x86_64.rpm SHA-256: c77c61eb2312bc240a5287d853c1b7f4abca4bd0302dc58cef4b50d9cc208079 tigervnc-debugsource-1.15.0-7.el9_8.2.x86_64.rpm SHA-256: 2399057acdc13ca67810d55119fe8783a1b37fe09cd7fc3288944eddca67e54d tigervnc-icons-1.15.0-7.el9_8.2.noarch.rpm SHA-256: 24f53478f97442aa8473daab1dc8e2265406c40c5a63a03b0285b0eae0daec5b tigervnc-license-1.15.0-7.el9_8.2.noarch.rpm SHA-256: f2d4fc9d0ca9d4ea0a92ba7bbae24e6775e32ffc778c24442c89382f34f289a2 tigervnc-selinux-1.15.0-7.el9_8.2.noarch.rpm SHA-256: 512d60a74f00757f199d792104553546fc72f4905fa6ee54d897b16f558efdf5 tigervnc-server-1.15.0-7.el9_8.2.x86_64.rpm SHA-256: d0143d34b2e3451db2def98086da582e34c0bd78951728904ab039d08651f3f8 tigervnc-server-debuginfo-1.15.0-7.el9_8.2.x86_64.rpm SHA-256: ccde871357b85e1c4cb5eb0b443598d6ce6efd48821cc0aea90cc66630a3f7a8 tigervnc-server-minimal-1.15.0-7.el9_8.2.x86_64.rpm SHA-256: 6c3be599756dfdd01d8f28f3e71c963bb2993836ebb8dcf4e9ecdff3b65f609d tigervnc-server-minimal-debuginfo-1.15.0-7.el9_8.2.x86_64.rpm SHA-256: 9bfd239accc5f50b5c5988fd18dc9944b4324c124f7650032682052e345ef445 tigervnc-server-module-1.15.0-7.el9_8.2.x86_64.rpm SHA-256: dbf611576ee5525eb0feb2c885eebad125978bf344207bc4ace4757725538d5e tigervnc-server-module-debuginfo-1.15.0-7.el9_8.2.x86_64.rpm SHA-256: 5e9d8b5112a0957de1555f745b809a31635fda8ebc90ac6630d6800dbeb5494b Red Hat Enterprise Linux for IBM z Systems 9 SRPM tigervnc-1.15.0-7.el9_8.2.src.rpm SHA-256: de19e3ca6a41d871ed72046efab089753c498c991bb7961d8ed430937def7baa s390x tigervnc-1.15.0-7.el9_8.2.s390x.rpm SHA-256: 02a75ba2bfacfc614f17f677be39aaa9fec4f3e509e1787c9ff7121311281ace tigervnc-debuginfo-1.15.0-7.el9_8.2.s390x.rpm SHA-256: 7c558ac617cdbb6167cac4c0cf3cd6a2e71d1b26a1288c52eee9b5b8d228db1e tigervnc-debugsource-1.15.0-7.el9_8.2.s390x.rpm SHA-256: 2f5bb20eb8d2f3148bf10c024c774af5e680e500fd648dcef32406728025d3c2 tigervnc-icons-1.15.0-7.el9_8.2.noarch.rpm SHA-256: 24f53478f97442aa8473daab1dc8e2265406c40c5a63a03b0285b0eae0daec5b tigervnc-license-1.15.0-7.el9_8.2.noarch.rpm SHA-256: f2d4fc9d0ca9d4ea0a92ba7bbae24e6775e32ffc778c24442c89382f34f289a2 tigervnc-selinux-1.15.0-7.el9_8.2.noarch.rpm SHA-256: 512d60a74f00757f199d792104553546fc72f4905fa6ee54d897b16f558efdf5 tigervnc-server-1.15.0-7.el9_8.2.s390x.rpm SHA-256: d0f1629d2f5f8a94e452443063ec522cd2f310365a117ab3a5c6c741ea5d20c6 tigervnc-server-debuginfo-1.15.0-7.el9_8.2.s390x.rpm SHA-256: f2f7de12749404149bd09036425a0993db8d7018a931c7c2c7d0c0388df4fc9c tigervnc-server-minimal-1.15.0-7.el9_8.2.s390x.rpm SHA-256: 253becd2f8f7b38e64af752dace2eff5d166c559bc307dbc859bea55718012b0 tigervnc-server-minimal-debuginfo-1.15.0-7.el9_8.2.s390x.rpm