Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Tigervnc: Unauthorized Access to Remote Sessions Possible

published 5 months ago

Summary

Tigervnc, a remote desktop server, has a security issue that could allow an attacker to gain unauthorized access to remote sessions. This affects organizations that use Tigervnc to remotely access systems. To protect your systems, update Tigervnc to the latest version.

What to do

Update redhat tigervnc to version 0:1.8.0-36.el7_9.4.
Update redhat tigervnc-debuginfo to version 0:1.8.0-36.el7_9.4.
Update redhat tigervnc-icons to version 0:1.8.0-36.el7_9.4.
Update redhat tigervnc-license to version 0:1.8.0-36.el7_9.4.
Update redhat tigervnc-server to version 0:1.8.0-36.el7_9.4.
Update redhat tigervnc-server-applet to version 0:1.8.0-36.el7_9.4.
Update redhat tigervnc-server-minimal to version 0:1.8.0-36.el7_9.4.
Update redhat tigervnc-server-module to version 0:1.8.0-36.el7_9.4.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_els:7	redhat	tigervnc	< 0:1.8.0-36.el7_9.4 Fix: upgrade to 0:1.8.0-36.el7_9.4
Red Hat:rhel_els:7	redhat	tigervnc-debuginfo	< 0:1.8.0-36.el7_9.4 Fix: upgrade to 0:1.8.0-36.el7_9.4
Red Hat:rhel_els:7	redhat	tigervnc-icons	< 0:1.8.0-36.el7_9.4 Fix: upgrade to 0:1.8.0-36.el7_9.4
Red Hat:rhel_els:7	redhat	tigervnc-license	< 0:1.8.0-36.el7_9.4 Fix: upgrade to 0:1.8.0-36.el7_9.4
Red Hat:rhel_els:7	redhat	tigervnc-server	< 0:1.8.0-36.el7_9.4 Fix: upgrade to 0:1.8.0-36.el7_9.4
Red Hat:rhel_els:7	redhat	tigervnc-server-applet	< 0:1.8.0-36.el7_9.4 Fix: upgrade to 0:1.8.0-36.el7_9.4
Red Hat:rhel_els:7	redhat	tigervnc-server-minimal	< 0:1.8.0-36.el7_9.4 Fix: upgrade to 0:1.8.0-36.el7_9.4
Red Hat:rhel_els:7	redhat	tigervnc-server-module	< 0:1.8.0-36.el7_9.4 Fix: upgrade to 0:1.8.0-36.el7_9.4

Original advisory text

Red Hat Security Advisory: tigervnc security update

References

https://access.redhat.com/errata/RHSA-2026:22456 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2451106 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2451107 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2451109 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2451112 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2451113 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2452022 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22456.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-33999 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-33999 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33999 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-34000 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-34000 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-34000 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-34001 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-34001 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-34001 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-34002 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-34002 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-34002 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-34003 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-34003 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-34003 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-34352 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-34352 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-34352 Vendor Advisory
https://github.com/TigerVNC/tigervnc/commit/0b5cab169d847789efa54459a87659d3fd48... Third Party Advisory
https://groups.google.com/g/tigervnc-announce/c/anHL9WLshLI Third Party Advisory
https://sourceforge.net/projects/tigervnc/files/stable/1.16.2 Third Party Advisory
https://www.openwall.com/lists/oss-security/2026/03/26/7 Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

7.8 High

Timeline

Published3 Jun 2026

Updated3 Jun 2026

First seen3 Jun 2026

Sources

RHSA-2026:22456 · OSV

Track software like this

Free during beta