Read the docs
TI-2014-00011 Aliases CVE-2014-0011GHSA-v8hp-82fx-5fhc

Out-of-bounds write in TigerVNC

Priority MEDIUM 47CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

Multiple heap-based buffer overflows in the ZRLE_DECODE function in common/rfb/zrleDecode.h in TigerVNC before 1.3.1, when NDEBUG is enabled, allow remote VNC servers to cause a denial of service (vncviewer crash) and possibly execute arbitrary code via vectors related to screen image rendering.

Why it matters now

EPSS 0.02494 84th percentileScored 2026-11-07
Fix Fixed TigerVNC (TigerVNC): 1.3.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
TigerVNCTigerVNCbefore 1.3.11.3.1Patch availableCNA
  • TigerVNC VendorTigerVNC Affected before 1.3.1 Fixed in 1.3.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:tigervnc:tigervnc:*:*:*:*:*:*:*:*before 1.3.1VulnerableTigerVNC
  • cpe:2.3:a:tigervnc:tigervnc:*:*:*:*:*:*:*:* Versions before 1.3.1 Vulnerable ·TigerVNC

Remediation

  • Fix · CNA TigerVNC (TigerVNC) Fixed in 1.3.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 3 products
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-0011
  2. 2026-10-03 Alias added: GHSA-v8hp-82fx-5fhc

References

Patch 1

Advisory 1

  • TI-2026-26639 Incorrect permission assignment in TigerVNC CVSS 3.1CRITICAL 9.8
  • TI-2017-03586 Buffer overflow in the ModifiablePixelBuffer::fillRect function in TigerVNC before 1.7.1… CVSS 3.0CRITICAL 9.8
  • TI-2014-06801 XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer… CVSS 3.0CRITICAL 9.8
  • TI-2023-05938 Xorg-x11-server: out-of-bounds memory read in rrchangeoutputproperty and rrchangeproviderproperty CVSS 3.1HIGH 7.6
  • TI-2017-05047 In TigerVNC 1.7.1 (VNCSConnectionST.cxx VNCSConnectionST::fence), an authenticated client… CVSS 3.0HIGH 8.8
  • TI-2020-15960 In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers… CVSS 3.1HIGH 8.1
See all 29 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences