This Red Hat security advisory addresses multiple high-severity vulnerabilities (CVSS 7.8) in the xorg-x11-server component used by TigerVNC, including stack buffer overflows and use-after-free flaws that could lead to privilege escalation or information disclosure. The underlying vulnerabilities affect x.org X Server versions prior to 21.1.23 and Xwayland versions prior to 24.1.12, impacting Red Hat Enterprise Linux 7.0, 8.0, and 9.0. The update provides the patched packages for RHEL 9.6 Extended Update Support, and administrators should apply the referenced errata to remediate affected systems.
Red Hat Product Errata RHSA-2026:46392 - Security Advisory Issued: 2026-07-27 Updated: 2026-07-27 RHSA-2026:46392 - Security Advisory Overview Updated Packages Synopsis Important: tigervnc security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for tigervnc is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients. Security Fix(es): xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch (CVE-2026-50256) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence() (CVE-2026-50257) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels (CVE-2026-50258) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing (CVE-2026-50259) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in FreeCounter() (CVE-2026-50260) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter() (CVE-2026-50261) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes (CVE-2026-50262) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow() (CVE-2026-50263) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat (CVE-2026-50264) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 x86_64 Red Hat Enterprise Linux Server - AUS 9.6 x86_64 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 s390x Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 ppc64le Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6 s390x Fixes BZ - 2485380 - CVE-2026-50256 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch BZ - 2485382 - CVE-2026-50257 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence() BZ - 2485383 - CVE-2026-50258 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels BZ - 2485384 - CVE-2026-50259 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing BZ - 2485385 - CVE-2026-50260 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in FreeCounter() BZ - 2485386 - CVE-2026-50261 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter() BZ - 2485387 - CVE-2026-50262 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes BZ - 2485388 - CVE-2026-50263 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow() BZ - 2485389 - CVE-2026-50264 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat CVEs CVE-2026-50256 CVE-2026-50257 CVE-2026-50258 CVE-2026-50259 CVE-2026-50260 CVE-2026-50261 CVE-2026-50262 CVE-2026-50263 CVE-2026-50264 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 SRPM tigervnc-1.14.1-11.el9_6.src.rpm SHA-256: 8dbd80e13dfd03a6fe1d01cb87ead0f8702386c90e8adc326168f059d243dc38 x86_64 tigervnc-1.14.1-11.el9_6.x86_64.rpm SHA-256: 14f71ea2d4eefb5489cd605352127f4542af9e15b5a45fedcd2746e71c3fb1b0 tigervnc-debuginfo-1.14.1-11.el9_6.x86_64.rpm SHA-256: c3720e662cd693e29569ffb8bf6a55518e4b3fc652249af80f947b34bb76da86 tigervnc-debugsource-1.14.1-11.el9_6.x86_64.rpm SHA-256: ecb0c0116e227caf73802123b96e740cd7cd457dd99c8a0a3aede915ba44d9d4 tigervnc-icons-1.14.1-11.el9_6.noarch.rpm SHA-256: 748f98a46e4126d9f2024fb0ed0de7b3d736d6753692b1ba16f529e0f9736783 tigervnc-license-1.14.1-11.el9_6.noarch.rpm SHA-256: ab3b0d8bc9d4a1430f2b097359bd2780838f610b53991e9e3f4a03bc0c576cef tigervnc-selinux-1.14.1-11.el9_6.noarch.rpm SHA-256: a0bf9593edfca4dfe737139ba9875c677dfeda28387edb5496950101de2e2ac1 tigervnc-server-1.14.1-11.el9_6.x86_64.rpm SHA-256: d2ff8137a26f90a27a63c2c849f8a982180838af96d988915de68a7dc1acf8c8 tigervnc-server-debuginfo-1.14.1-11.el9_6.x86_64.rpm SHA-256: a84c0beac4b993c2890c299a86ed32d7167b2b65cfa437e8c8782710ca996456 tigervnc-server-minimal-1.14.1-11.el9_6.x86_64.rpm SHA-256: 862e177e1725c016494e88ad51a38b13e0676fc2cdfc2f649b1f621c3eb630ac tigervnc-server-minimal-debuginfo-1.14.1-11.el9_6.x86_64.rpm SHA-256: e9d0d129700ff08ddf3646ea931113742a12f3d7df6bedab59584017a7e3707c tigervnc-server-module-1.14.1-11.el9_6.x86_64.rpm SHA-256: 9b9d68304320ef5fadfd67d442e4693993078c8efef87d951651802d5c127d26 tigervnc-server-module-debuginfo-1.14.1-11.el9_6.x86_64.rpm SHA-256: cca75200e64b2bb226392cee02d9427397d2beabcdf3cfc4f0817853d8c3cf6e Red Hat Enterprise Linux Server - AUS 9.6 SRPM tigervnc-1.14.1-11.el9_6.src.rpm SHA-256: 8dbd80e13dfd03a6fe1d01cb87ead0f8702386c90e8adc326168f059d243dc38 x86_64 tigervnc-1.14.1-11.el9_6.x86_64.rpm SHA-256: 14f71ea2d4eefb5489cd605352127f4542af9e15b5a45fedcd2746e71c3fb1b0 tigervnc-debuginfo-1.14.1-11.el9_6.x86_64.rpm SHA-256: c3720e662cd693e29569ffb8bf6a55518e4b3fc652249af80f947b34bb76da86 tigervnc-debugsource-1.14.1-11.el9_6.x86_64.rpm SHA-256: ecb0c0116e227caf73802123b96e740cd7cd457dd99c8a0a3aede915ba44d9d4 tigervnc-icons-1.14.1-11.el9_6.noarch.rpm SHA-256: 748f98a46e4126d9f2024fb0ed0de7b3d736d6753692b1ba16f529e0f9736783 tigervnc-license-1.14.1-11.el9_6.noarch.rpm SHA-256: ab3b0d8bc9d4a1430f2b097359bd2780838f610b53991e9e3f4a03bc0c576cef tigervnc-selinux-1.14.1-11.el9_6.noarch.rpm SHA-256: a0bf9593edfca4dfe737139ba9875c677dfeda28387edb5496950101de2e2ac1 tigervnc-server-1.14.1-11.el9_6.x86_64.rpm SHA-256: d2ff8137a26f90a27a63c2c849f8a982180838af96d988915de68a7dc1acf8c8 tigervnc-server-debuginfo-1.14.1-11.el9_6.x86_64.rpm SHA-256: a84c0beac4b993c2890c299a86ed32d7167b2b65cfa437e8c8782710ca996456 tigervnc-server-minimal-1.14.1-11.el9_6.x86_64.rpm SHA-256: 862e177e1725c016494e88ad51a38b13e0676fc2cdfc2f649b1f621c3eb630ac tigervnc-server-minimal-debuginfo-1.14.1-11.el9_6.x86_64.rpm SHA-256: e9d0d129700ff08ddf3646ea931113742a12f3d7df6bedab59584017a7e3707c tigervnc-server-module-1.14.1-11.el9_6.x86_64.rpm SHA-256: 9b9d68304320ef5fadfd67d442e4693993078c8efef87d951651802d5c127d26 tigervnc-server-module-debuginfo-1.14.1-11.el9_6.x86_64.rpm SHA-256: cca75200e64b2bb226392cee02d9427397d2beabcdf3cfc4f0817853d8c3cf6e Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 SRPM tigervnc-1.14.1-11.el9_6.src.rpm SHA-256: 8dbd80e13dfd03a6fe1d01cb87ead0f8702386c90e8adc326168f059d243dc38 s390x tigervnc-1.14.1-11.el9_6.s390x.rpm SHA-256: 72c792211374d9b13384a9d15288c5af7eb5db23d4b6ecb67c6f16ae20eff1d0 tigervnc-debuginfo-1.14.1-11.el9_6.s390x.rpm SHA-256: c9438fd481c90dd76fcc9a3e077766f1ff7f68df64dab318bb882da8b30164a0 tigervnc-debugsource-1.14.1-11.el9_6.s390x.rpm SHA-256: 500ad67afad615455bb8eee36c5731f8ef8bdef18aaf5f04ba482c47fd195f25 tigervnc-icons-1.14.1-11.el9_6.noarch.rpm SHA-256: 748f98a46e4126d9f2024fb0ed0de7b3d736d6753692b1ba16f529e0f9736783 tigervnc-license-1.14.1-11.el9_6.noarch.rpm SHA-256: ab3b0d8bc9d4a1430f2b097359bd2780838f610b53991e9e3f4a03bc0c576cef tigervnc-selinux-1.14.1-11.el9_6.noarch.rpm SHA-256: a0bf9593edfca4dfe737139ba9875c677dfeda28387edb5496950101de2e2ac1 tigervnc-server-1.14.1-11.el9_6.s390x.rpm SHA-256: 68ab967da3407d79228ca594bc2d1326464404ac693ba39ddaf824f6fc6c224b tigervnc-server-debuginfo-1.14.1-11.el9_6.s390x.rpm SHA-256: 7cbfeccba8ec5d9e226256b6de3f28dab6964c2864c141e0d324e40930c5a7e1 tigervnc-server-minimal-1.14.1-11.el9_6.s390x.rpm SHA-256: 12a95c1d0b47c51788ddd32b50584145021339aadb0bd3b0099ddd7b6ced12d9 tigervnc-server-minimal-debuginfo-1.14.1-11.el9_6.s390x.rpm SHA-256: 65ae0641c6cbe58de4de2c4c306f28e871e122d9ab550809781b67bc41d91c6a tigervnc-server-module-1.14.1-11.el9_6.s390x.rpm SHA-256: