This advisory covers several vulnerabilities in TigerVNC and X.Org X server's xwayland component on Red Hat Enterprise Linux 9. The issues include an integer underflow causing denial of service (CVE-2026-33999), out-of-bounds reads leading to information disclosure and denial of service (CVE-2026-34000), a use-after-free vulnerability causing server crashes and potential memory corruption (CVE-2026-34001), out-of-bounds memory access causing information exposure and denial of service (CVE-2026-34003), and incorrect permissions in TigerVNC's x0vncserver leading to information disclosure, data manipulation, and denial of service (CVE-2026-34352). These vulnerabilities have been addressed in updated TigerVNC packages provided by Red Hat.

Successful exploitation of these vulnerabilities can result in denial of service conditions, information disclosure, data manipulation, server crashes, and potential memory corruption. The impact includes confidentiality, integrity, and availability concerns for affected systems running vulnerable versions of TigerVNC and X.Org X server components.

Red Hat has released updated TigerVNC packages (version 1.15.0-7.el9_8.1) for Red Hat Enterprise Linux 9 that address these vulnerabilities. Users should apply these official security updates promptly. For detailed update instructions, refer to Red Hat's advisory at https://access.redhat.com/articles/11258. No alternative mitigations are specified, and patching is the recommended remediation.