This advisory covers four security vulnerabilities affecting TigerVNC and the X.Org X server's xwayland component on Red Hat Enterprise Linux 9. The issues include an integer underflow causing denial of service (CVE-2026-33999), a use-after-free vulnerability that can lead to server crashes and potential memory corruption (CVE-2026-34001), out-of-bounds memory access causing information exposure and denial of service (CVE-2026-34003), and incorrect permissions in TigerVNC's x0vncserver leading to information disclosure, data manipulation, and denial of service (CVE-2026-34352). These vulnerabilities have been addressed in updated TigerVNC packages provided by Red Hat.

Successful exploitation of these vulnerabilities could result in denial of service conditions, server crashes, potential memory corruption, information disclosure, and unauthorized data manipulation on affected systems running TigerVNC and X.Org X server components. The issues affect remote display capabilities, potentially impacting system availability and confidentiality.

Red Hat has released updated TigerVNC packages for Red Hat Enterprise Linux 9 that address these vulnerabilities. Users should apply the security update as detailed in Red Hat advisory RHSA-2026:10739. For update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.