TigerVNC is a lean, open-source remote-desktop software project that despite its narrow product focus occupies a prominent position in the VNC implementation landscape, particularly in server and client deployments across enterprise and Unix-like systems. The vendor's vulnerability disclosures skew toward serious outcomes, with a meaningful share reaching critical severity, reflecting the memory-safety and input-parsing demands inherent to a graphics-protocol implementation that handles untrusted network data. Recurring weakness classes center on out-of-bounds writes, heap-based buffer overflows, use-after-free conditions, and improper input validation—classic memory-corruption and bounds-checking failures that arise when parsing remote framebuffer and protocol-state updates from untrusted peers. These vulnerability patterns are characteristic of native codebases handling binary protocols and make TigerVNC a worthwhile tracking priority for defenders managing remote-access infrastructure. Live severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Tigervnc over time
Signals from CVEs in this vendor scope (30 CVEs).
30 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-34352CRITICAL In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an application crash, because of incorrect permissions | Mar 26, 2026 | 9.8 | 34 | NO | NO |
CVE-2017-5581CRITICAL Buffer overflow in the ModifiablePixelBuffer::fillRect function in TigerVNC before 1.7.1 allows remote servers to execute arbitrary code via an RRE message with subrectangle outsid | Feb 28, 2017 | 9.8 | 33 | NO | NO |
CVE-2014-0011CRITICAL Multiple heap-based buffer overflows in the ZRLE_DECODE function in common/rfb/zrleDecode.h in TigerVNC before 1.3.1, when NDEBUG is enabled, allow remote VNC servers to cause a de | Jan 2, 2020 | 9.8 | 32 | NO | NO |
CVE-2017-7393HIGH In TigerVNC 1.7.1 (VNCSConnectionST.cxx VNCSConnectionST::fence), an authenticated client can cause a double free, leading to denial of service or potentially code execution. | Apr 1, 2017 | 8.8 | 28 | NO | NO |
CVE-2020-26117HIGH In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that | Sep 27, 2020 | 8.1 | 27 | NO | NO |
CVE-2025-26601HIGH A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the trigger values as reque | Feb 25, 2025 | 7.8 | 26 | NO | NO |
CVE-2025-26600HIGH A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying th | Feb 25, 2025 | 7.8 | 26 | NO | NO |
CVE-2025-26599HIGH An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRe | Feb 25, 2025 | 7.8 | 26 | NO | NO |
CVE-2025-26598HIGH An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the pointer device based on its device ID and returns the matching value, | Feb 25, 2025 | 7.8 | 26 | NO | NO |
CVE-2025-26597HIGH A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey() is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions uncha | Feb 25, 2025 | 7.8 | 26 | NO | NO |
Signals from CVEs in this vendor scope (30 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Tigervnc.
Media articles that mention a CVE ID that affects a product developed by Tigervnc — matched by CVE ID, not by vendor name.