This Red Hat security advisory addresses multiple high-severity vulnerabilities (CVSS 7.8) in the xorg-x11-server component used by TigerVNC, including stack buffer overflows and use-after-free flaws that could lead to privilege escalation. The flaws affect Red Hat Enterprise Linux 7 Extended Lifecycle Support systems running vulnerable versions of the x_server (< 21.1.23) and xwayland (< 24.1.12) packages. The update provides patched packages to remediate these issues.
Red Hat Product Errata RHSA-2026:46473 - Security Advisory Issued: 2026-07-27 Updated: 2026-07-27 RHSA-2026:46473 - Security Advisory Overview Updated Packages Synopsis Important: tigervnc security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for tigervnc is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients. Security Fix(es): xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch (CVE-2026-50256) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence() (CVE-2026-50257) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels (CVE-2026-50258) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing (CVE-2026-50259) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in FreeCounter() (CVE-2026-50260) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter() (CVE-2026-50261) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes (CVE-2026-50262) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow() (CVE-2026-50263) xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat (CVE-2026-50264) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64 Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64 Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le Fixes BZ - 2485380 - CVE-2026-50256 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch BZ - 2485382 - CVE-2026-50257 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence() BZ - 2485383 - CVE-2026-50258 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels BZ - 2485384 - CVE-2026-50259 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing BZ - 2485385 - CVE-2026-50260 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in FreeCounter() BZ - 2485386 - CVE-2026-50261 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter() BZ - 2485387 - CVE-2026-50262 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes BZ - 2485388 - CVE-2026-50263 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow() BZ - 2485389 - CVE-2026-50264 xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat CVEs CVE-2026-50256 CVE-2026-50257 CVE-2026-50258 CVE-2026-50259 CVE-2026-50260 CVE-2026-50261 CVE-2026-50262 CVE-2026-50263 CVE-2026-50264 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 SRPM tigervnc-1.8.0-36.el7_9.5.src.rpm SHA-256: cc7de66c36d082c2b153d523468fc600e8f02bc7fa1051967b0ec8bd6bff3e0b x86_64 tigervnc-1.8.0-36.el7_9.5.x86_64.rpm SHA-256: 9ba1643774816803739a461ff9be97c750362106a0f2e6beea7949c5f24dbf59 tigervnc-debuginfo-1.8.0-36.el7_9.5.x86_64.rpm SHA-256: 63d3bd4d4837d84b566f70d59f65d5005bc9367a9ea0dc01a54aecf9613ca9ab tigervnc-debuginfo-1.8.0-36.el7_9.5.x86_64.rpm SHA-256: 63d3bd4d4837d84b566f70d59f65d5005bc9367a9ea0dc01a54aecf9613ca9ab tigervnc-icons-1.8.0-36.el7_9.5.noarch.rpm SHA-256: 5178560abf67e209e3afe617dd6172dd2ed0a79aaf22d08121d8c9648c749059 tigervnc-license-1.8.0-36.el7_9.5.noarch.rpm SHA-256: 14365ac96937f99ff475d203ff36f4d92394fc94a0504452d196a0fe5c636303 tigervnc-server-1.8.0-36.el7_9.5.x86_64.rpm SHA-256: c1abc89ece391f8f416df60187ec99c2b68aea1b07bb05328c2ce2922612c3be tigervnc-server-applet-1.8.0-36.el7_9.5.noarch.rpm SHA-256: e3d072c20850e9cd4bdbb65279472d953407d8e34c7290c1dd76688f29687eed tigervnc-server-minimal-1.8.0-36.el7_9.5.x86_64.rpm SHA-256: c4674eeed3726ad8f7a460c03dbd54f87d1573d0698d1c41aec62f8740c00f41 tigervnc-server-module-1.8.0-36.el7_9.5.x86_64.rpm SHA-256: cd274f568ae2bb586a726e11083cb2fe7eb34041d43965ff23514e42d53c899b Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 SRPM tigervnc-1.8.0-36.el7_9.5.src.rpm SHA-256: cc7de66c36d082c2b153d523468fc600e8f02bc7fa1051967b0ec8bd6bff3e0b s390x tigervnc-1.8.0-36.el7_9.5.s390x.rpm SHA-256: 169a39417160a2cf5ebe8c76eaa4bafc75fb9e1bc12987ed200b70af1d006bfb tigervnc-debuginfo-1.8.0-36.el7_9.5.s390x.rpm SHA-256: 83d0814ee21bd9fd4cd3101fb10d348ce1718c047d52c1ad1ed21b114787d529 tigervnc-icons-1.8.0-36.el7_9.5.noarch.rpm SHA-256: 5178560abf67e209e3afe617dd6172dd2ed0a79aaf22d08121d8c9648c749059 tigervnc-license-1.8.0-36.el7_9.5.noarch.rpm SHA-256: 14365ac96937f99ff475d203ff36f4d92394fc94a0504452d196a0fe5c636303 tigervnc-server-1.8.0-36.el7_9.5.s390x.rpm SHA-256: 10318b66ca26523595bf8ea8bd129e5565b0e5dfe360fab538d60354de6f4afa tigervnc-server-applet-1.8.0-36.el7_9.5.noarch.rpm SHA-256: e3d072c20850e9cd4bdbb65279472d953407d8e34c7290c1dd76688f29687eed tigervnc-server-minimal-1.8.0-36.el7_9.5.s390x.rpm SHA-256: 5e839628542e070ca9e11e8a662eb0c759e22d13ad7fb0b164b022290122679e Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 SRPM tigervnc-1.8.0-36.el7_9.5.src.rpm SHA-256: cc7de66c36d082c2b153d523468fc600e8f02bc7fa1051967b0ec8bd6bff3e0b ppc64 tigervnc-icons-1.8.0-36.el7_9.5.noarch.rpm SHA-256: 5178560abf67e209e3afe617dd6172dd2ed0a79aaf22d08121d8c9648c749059 tigervnc-license-1.8.0-36.el7_9.5.noarch.rpm SHA-256: 14365ac96937f99ff475d203ff36f4d92394fc94a0504452d196a0fe5c636303 tigervnc-server-applet-1.8.0-36.el7_9.5.noarch.rpm SHA-256: e3d072c20850e9cd4bdbb65279472d953407d8e34c7290c1dd76688f29687eed Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 SRPM tigervnc-1.8.0-36.el7_9.5.src.rpm SHA-256: cc7de66c36d082c2b153d523468fc600e8f02bc7fa1051967b0ec8bd6bff3e0b ppc64le tigervnc-1.8.0-36.el7_9.5.ppc64le.rpm SHA-256: 976312f10a364b9be515b8ade469f574ca8f96de58948a6de108f6d4b3ef465f tigervnc-debuginfo-1.8.0-36.el7_9.5.ppc64le.rpm SHA-256: 034f05516a228e804aeff8fe7b7294d2b3c2ea7b8e1112ca220d2667145f51c2 tigervnc-debuginfo-1.8.0-36.el7_9.5.ppc64le.rpm SHA-256: 034f05516a228e804aeff8fe7b7294d2b3c2ea7b8e1112ca220d2667145f51c2 tigervnc-icons-1.8.0-36.el7_9.5.noarch.rpm SHA-256: 5178560abf67e209e3afe617dd6172dd2ed0a79aaf22d08121d8c9648c749059 tigervnc-license-1.8.0-36.el7_9.5.noarch.rpm SHA-256: 14365ac96937f99ff475d203ff36f4d92394fc94a0504452d196a0fe5c636303 tigervnc-server-1.8.0-36.el7_9.5.ppc64le.rpm SHA-256: e72a5bd7eee774f4d2f41ac930073197ea53f14476872c3d0fd4aa6720a55176 tigervnc-server-applet-1.8.0-36.el7_9.5.noarch.rpm SHA-256: e3d072c20850e9cd4bdbb65279472d953407d8e34c7290c1dd76688f29687eed tigervnc-server-minimal-1.8.0-36.el7_9.5.ppc64le.rpm SHA-256: 24416c67984f1eb497fb62d8ce2531a6ae1d218ef6e3283df547dbb455031e11 tigervnc-server-module-1.8.0-36.el7_9.5.ppc64le.rpm SHA-256: bb7b59ebc6617f47a23ad32034e6d6889a50d70e9ed229ad37a99011e48591c6 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .