Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 30

Export CSV
CVE-2025-26601

Xorg: xwayland: use-after-free in syncinittrigger()

A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the trigger values as requested, and eventually, SyncInitTrigger() is called. If one of the changes triggers an error, the function will return early, not adding the new sync object, possibly causing a use-after-free when the alarm eventually triggers.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat Tigervnc X.org
Products
Enterprise Linux Rhel Aus Rhel E4s and 6 more
CVE-2025-26600

Xorg: xwayland: use-after-free in playreleasedevents()

A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying the events will cause a use-after-free.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat Tigervnc X.org
Products
Enterprise Linux Rhel Aus Rhel E4s and 6 more
CVE-2025-26598

Xorg: xwayland: out-of-bounds write in createpointerbarrierclient()

An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the last element of the list if no matching device ID is found, which can lead to out-of-bounds memory access.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat Tigervnc X.org
Products
Enterprise Linux Rhel Aus Rhel E4s and 6 more
CVE-2025-26599

Xorg: xwayland: use of uninitialized pointer in compredirectwindow()

An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree marked just before, which leaves the validated data partly initialized and the use of an uninitialized pointer later.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat Tigervnc X.org
Products
Enterprise Linux Rhel Aus Rhel E4s and 6 more
CVE-2025-26597

Xorg: xwayland: buffer overflow in xkbchangetypesofkey()

A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey() is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, this will cause a buffer overflow because the key actions are of the wrong size.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat Tigervnc X.org
Products
Enterprise Linux Rhel Aus Rhel E4s and 6 more
CVE-2025-26596

Xorg: xwayland: heap overflow in xkbwritekeysyms()

A heap overflow flaw was found in X.Org and Xwayland. The computation of the length in XkbSizeKeySyms() differs from what is written in XkbWriteKeySyms(), which may lead to a heap-based buffer overflow.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat Tigervnc X.org
Products
Enterprise Linux Rhel Aus Rhel E4s and 6 more
CVE-2025-26595

Xorg: xwayland: buffer overflow in xkbvmodmasktext()

A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat Tigervnc X.org
Products
Enterprise Linux Rhel Aus Rhel E4s and 6 more
CVE-2025-26594

X.org: xwayland: use-after-free of the root cursor

A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat Tigervnc X.org
Products
Enterprise Linux Rhel Aus Rhel E4s and 6 more
CVE-2024-0409

Xorg-x11-server: selinux context corruption

A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat Tigervnc and 1 more
Products
Fedora Enterprise Linux Enterprise Linux Desktop and 10 more
CVE-2024-0408

Xorg-x11-server: selinux unlabeled glx pbuffer

A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a GetGeometry) or when it creates another resource that needs to access that buffer, such as a GC, the XSELINUX code will try to use an object that was never labeled and crash because the SID is NULL.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat Tigervnc and 1 more
Products
Fedora Enterprise Linux Enterprise Linux Desktop and 10 more
CVE-2023-6377

Xorg-x11-server: out-of-bounds memory reads/writes in xkb button actions

A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or possible remote code execution in cases where X11 forwarding is involved.

CVSS 3.1 · 7.8 High EPSS 1.6% KEV · Not listed
Vendors
Debian Redhat Tigervnc and 1 more
Products
Debian Linux Enterprise Linux Enterprise Linux Eus and 8 more
CVE-2023-6478

Xorg-x11-server: out-of-bounds memory read in rrchangeoutputproperty and rrchangeproviderproperty

A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive information.

CVSS 3.1 · 7.6 High EPSS 1.6% KEV · Not listed
Vendors
Debian Redhat Tigervnc and 1 more
Products
Debian Linux Enterprise Linux Enterprise Linux Eus and 8 more
CVE-2026-34352

TigerVNC: x0vncserver: TigerVNC x0vncserver: Information disclosure, data manipulation, and denial of service via incorrect permissions

In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an application crash, because of incorrect permissions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Tigervnc
Products
Tigervnc
CVE-2016-10207

tigervnc: VNC server can crash when TLS handshake terminates early

The Xvnc server in TigerVNC allows remote attackers to cause a denial of service (invalid memory access and crash) by terminating a TLS handshake early.

CVSS 3.0 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Opensuse Redhat Tigervnc
Products
Leap Enterprise Linux Tigervnc
CVE-2017-7393

tigervnc: Double free via crafted fences

In TigerVNC 1.7.1 (VNCSConnectionST.cxx VNCSConnectionST::fence), an authenticated client can cause a double free, leading to denial of service or potentially code execution.

CVSS 3.0 · 8.8 High EPSS 1.8% KEV · Not listed
Vendors
Redhat Tigervnc
Products
Enterprise Linux Tigervnc
CVE-2017-7394

tigervnc: Server crash via long usernames

In TigerVNC 1.7.1 (SSecurityPlain.cxx SSecurityPlain::processMsg), unauthenticated users can crash the server by sending long usernames.

CVSS 3.0 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Redhat Tigervnc
Products
Enterprise Linux Tigervnc
CVE-2017-7395

tigervnc: Integer overflow in SMsgReader::readClientCutText

In TigerVNC 1.7.1 (SMsgReader.cxx SMsgReader::readClientCutText), by causing an integer overflow, an authenticated client can crash the server.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Redhat Tigervnc
Products
Enterprise Linux Tigervnc
CVE-2017-7396

tigervnc: SecurityServer and ClientServer memory leaks

In TigerVNC 1.7.1 (CConnection.cxx CConnection::CConnection), an unauthenticated client can cause a small memory leak in the server.

CVSS 3.0 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Redhat Tigervnc
Products
Enterprise Linux Tigervnc
CVE-2017-7392

tigervnc: SSecurityVeNCrypt memory leak

In TigerVNC 1.7.1 (SSecurityVeNCrypt.cxx SSecurityVeNCrypt::SSecurityVeNCrypt), an unauthenticated client can cause a small memory leak in the server.

CVSS 3.0 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Redhat Tigervnc
Products
Enterprise Linux Tigervnc
CVE-2017-5581

tigervnc: Buffer overflow in ModifiablePixelBuffer::fillRect

Buffer overflow in the ModifiablePixelBuffer::fillRect function in TigerVNC before 1.7.1 allows remote servers to execute arbitrary code via an RRE message with subrectangle outside framebuffer boundaries.

CVSS 3.0 · 9.8 Critical EPSS 4.2% KEV · Not listed
Vendors
Redhat Tigervnc
Products
Enterprise Linux Tigervnc