Integer overflow in TigerVNC allows remote VNC servers to cause a denial of service…
Priority LOW 39CWE-119Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- Partial Red Hat: 8 fixed, 2 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.
Summary
Integer overflow in TigerVNC allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to screen size handling, which triggers a heap-based buffer overflow, a similar issue to CVE-2014-6051.
Why it matters now
EPSS 0.03547 89th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 8 fixed, 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tigervnc:tigervnc:0.0.90:*:*:*:*:*:*:* | 0.0.90 | Vulnerable | TigerVNC |
| cpe:2.3:a:tigervnc:tigervnc:0.0.91:*:*:*:*:*:*:* | 0.0.91 | Vulnerable | TigerVNC |
| cpe:2.3:a:tigervnc:tigervnc:1.0.0:*:*:*:*:*:*:* | 1.0.0 | Vulnerable | TigerVNC |
| cpe:2.3:a:tigervnc:tigervnc:1.0.1:*:*:*:*:*:*:* | 1.0.1 | Vulnerable | TigerVNC |
| cpe:2.3:a:tigervnc:tigervnc:1.1.0:*:*:*:*:*:*:* | 1.1.0 | Vulnerable | TigerVNC |
- cpe:2.3:a:tigervnc:tigervnc:0.0.90:*:*:*:*:*:*:* Versions 0.0.90 Vulnerable ·TigerVNC
- cpe:2.3:a:tigervnc:tigervnc:0.0.91:*:*:*:*:*:*:* Versions 0.0.91 Vulnerable ·TigerVNC
- cpe:2.3:a:tigervnc:tigervnc:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·TigerVNC
- cpe:2.3:a:tigervnc:tigervnc:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·TigerVNC
- cpe:2.3:a:tigervnc:tigervnc:1.1.0:*:*:*:*:*:*:* Versions 1.1.0 Vulnerable ·TigerVNC
Remediation
Red Hat 1 advisory
- RHSA-2015:2233 Released 2015-11-19 · Red Hat rating Moderatetigervnc security, bug fix, and enhancement update
- Red Hat Enterprise Linux Client (v. 7) tigervnc-1.3.1-3.el7, tigervnc-icons-1.3.1-3.el7, tigervnc-license-1.3.1-3.el7 +2
- Red Hat Enterprise Linux Client Optional (v. 7) tigervnc-server-applet-1.3.1-3.el7, tigervnc-server-module-1.3.1-3.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) tigervnc-1.3.1-3.el7, tigervnc-license-1.3.1-3.el7, tigervnc-server-minimal-1.3.1-3.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) tigervnc-1.3.1-3.el7, tigervnc-icons-1.3.1-3.el7, tigervnc-server-1.3.1-3.el7 +2
- Red Hat Enterprise Linux Server (v. 7) tigervnc-1.3.1-3.el7, tigervnc-icons-1.3.1-3.el7, tigervnc-license-1.3.1-3.el7 +2
- Red Hat Enterprise Linux Server Optional (v. 7) tigervnc-server-applet-1.3.1-3.el7, tigervnc-server-module-1.3.1-3.el7
- Red Hat Enterprise Linux Workstation (v. 7) tigervnc-1.3.1-3.el7, tigervnc-icons-1.3.1-3.el7, tigervnc-license-1.3.1-3.el7 +2
- Red Hat Enterprise Linux Workstation Optional (v. 7) tigervnc-server-applet-1.3.1-3.el7, tigervnc-server-module-1.3.1-3.el7
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2015:2233 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2015:2233 |
| Red Hat Enterprise Linux ComputeNode (v. 7) | Fixed | RHSA-2015:2233 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2015:2233 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2015:2233 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2015:2233 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2015:2233 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2015:2233 |
Timeline
- 2026-10-02 Threatist record created from CVE-2014-8240
- 2026-10-03 Alias added: GHSA-5qgx-8v4m-83gf
References
Advisory 1
Other 5
- https://bugzilla.redhat.com/show_bug.cgi?id=1151307
- [oss-security] 20141010 Request for CVE assignment for tigervnc affected by similar flaws as in CVE-2014-6051 and CVE-2014-6052 of libvncserver
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- [oss-security] 20141011 Re: Request for CVE assignment for tigervnc affected by similar flaws as in CVE-2014-6051 and CVE-2014-6052 of libvncserver
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
More Tigervnc vulnerabilities
- TI-2026-26639 Incorrect permission assignment in TigerVNC CVSS 3.1CRITICAL 9.8
- TI-2017-03586 Buffer overflow in the ModifiablePixelBuffer::fillRect function in TigerVNC before 1.7.1… CVSS 3.0CRITICAL 9.8
- TI-2014-06801 XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer… CVSS 3.0CRITICAL 9.8
- TI-2014-00011 Out-of-bounds write in TigerVNC CVSS 3.1CRITICAL 9.8
- TI-2023-05938 Xorg-x11-server: out-of-bounds memory read in rrchangeoutputproperty and rrchangeproviderproperty CVSS 3.1HIGH 7.6
- TI-2017-05047 In TigerVNC 1.7.1 (VNCSConnectionST.cxx VNCSConnectionST::fence), an authenticated client… CVSS 3.0HIGH 8.8
Sources
- CVE-2014-8240 · CVE Program
- CVE-2014-8240 · NVD
- FIRST EPSS
- GHSA-5qgx-8v4m-83gf · GitHub Advisory Database · CC BY 4.0
- CVE-2014-8240 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences