CVE-2026-34352 | High | 8.5 | 2026-03-26 | In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an application crash, because of… |
CVE-2025-26601 | High | 7.8 | 2025-02-25 | A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the tr… |
CVE-2025-26600 | High | 7.8 | 2025-02-25 | A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device i… |
CVE-2025-26599 | High | 7.8 | 2025-02-25 | An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap… |
CVE-2025-26598 | High | 7.8 | 2025-02-25 | An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the pointer device based on its device ID and returns… |
CVE-2025-26597 | High | 7.8 | 2025-02-25 | A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey() is called with a 0 group, it will resize the key symbols table to 0 but leave… |
CVE-2025-26596 | High | 7.8 | 2025-02-25 | A heap overflow flaw was found in X.Org and Xwayland. The computation of the length in XkbSizeKeySyms() differs from what is written in XkbWriteKeySyms(), whic… |
CVE-2025-26595 | High | 7.8 | 2025-02-25 | A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the v… |
CVE-2025-26594 | High | 7.8 | 2025-02-25 | A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, t… |
CVE-2024-0409 | High | 7.8 | 2024-01-18 | A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with… |
CVE-2024-0408 | Medium | 5.5 | 2024-01-18 | A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues a… |
CVE-2023-6478 | High | 7.6 | 2023-12-13 | A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may le… |
CVE-2023-6377 | High | 7.8 | 2023-12-13 | A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and… |
CVE-2020-26117 | High | 8.1 | 2020-09-27 | In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as autho… |
CVE-2014-0011 | Critical | 9.8 | 2020-01-02 | Multiple heap-based buffer overflows in the ZRLE_DECODE function in common/rfb/zrleDecode.h in TigerVNC before 1.3.1, when NDEBUG is enabled, allow remote VNC… |
CVE-2019-15695 | High | 7.2 | 2019-12-26 | TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from CMsgReader::readSetCursor. This vulnerability occurs due… |
CVE-2019-15694 | High | 7.2 | 2019-12-26 | TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered from DecodeManager::decodeRect. Vulnerability occurs due to th… |
CVE-2019-15693 | High | 7.2 | 2019-12-26 | TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in TightDecoder::FilterGradient. Exploitation of this vulnerability could… |
CVE-2019-15692 | High | 7.2 | 2019-12-26 | TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow. Vulnerability could be triggered from CopyRectDecoder due to incorrect value checks. Ex… |
CVE-2019-15691 | High | 7.2 | 2019-12-26 | TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoder. If decoding routi… |
CVE-2017-7396 | High | 7.5 | 2017-04-01 | In TigerVNC 1.7.1 (CConnection.cxx CConnection::CConnection), an unauthenticated client can cause a small memory leak in the server. |
CVE-2017-7395 | Medium | 6.5 | 2017-04-01 | In TigerVNC 1.7.1 (SMsgReader.cxx SMsgReader::readClientCutText), by causing an integer overflow, an authenticated client can crash the server. |
CVE-2017-7394 | High | 7.5 | 2017-04-01 | In TigerVNC 1.7.1 (SSecurityPlain.cxx SSecurityPlain::processMsg), unauthenticated users can crash the server by sending long usernames. |
CVE-2017-7393 | High | 8.8 | 2017-04-01 | In TigerVNC 1.7.1 (VNCSConnectionST.cxx VNCSConnectionST::fence), an authenticated client can cause a double free, leading to denial of service or potentially… |
CVE-2017-7392 | High | 7.5 | 2017-04-01 | In TigerVNC 1.7.1 (SSecurityVeNCrypt.cxx SSecurityVeNCrypt::SSecurityVeNCrypt), an unauthenticated client can cause a small memory leak in the server. |
CVE-2017-5581 | Critical | 9.8 | 2017-02-28 | Buffer overflow in the ModifiablePixelBuffer::fillRect function in TigerVNC before 1.7.1 allows remote servers to execute arbitrary code via an RRE message wit… |
CVE-2016-10207 | High | 7.5 | 2017-02-28 | The Xvnc server in TigerVNC allows remote attackers to cause a denial of service (invalid memory access and crash) by terminating a TLS handshake early. |
CVE-2014-8241 | Critical | 9.8 | 2016-12-14 | XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer dereference) by leveraging failure to check a malloc return value, a s… |
CVE-2014-8240 | | | 2014-10-16 | Integer overflow in TigerVNC allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to screen s… |
CVE-2011-1775 | | | 2011-05-26 | The CSecurityTLS::processMsg function in common/rfb/CSecurityTLS.cxx in the vncviewer component in TigerVNC 1.1beta1 does not properly verify the server's X.50… |