TigerVNC, a suite of VNC servers and clients used in Red Hat Enterprise Linux 9, contains multiple vulnerabilities: CVE-2026-33999 is an integer underflow in XKB compatibility map handling causing denial of service; CVE-2026-34001 is a use-after-free in xwayland leading to server crash and potential memory corruption; CVE-2026-34003 involves out-of-bounds memory access causing information exposure and denial of service; CVE-2026-34352 in TigerVNC's x0vncserver allows information disclosure, data manipulation, and denial of service via incorrect permissions. Red Hat has issued an update (RHSA-2026:10739) that fixes these vulnerabilities in the tigervnc package for Red Hat Enterprise Linux 9.

The vulnerabilities can cause denial of service conditions, server crashes, potential memory corruption, information disclosure, and unauthorized data manipulation. These impacts affect the stability and confidentiality of systems running vulnerable versions of TigerVNC and X.Org X server components on Red Hat Enterprise Linux 9. No known exploits in the wild have been reported at this time.

Red Hat has released an official security update for tigervnc in Red Hat Enterprise Linux 9 that addresses these vulnerabilities. Users should apply the update tigervnc-1.15.0-6.el9_7.1 or later as provided in advisory RHSA-2026:10739. For detailed instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation actions are indicated by the vendor advisory.