CVE-2024-9632 is a heap-based buffer overflow vulnerability in the tigervnc component of the xorg-x11-server package. TigerVNC is a suite of VNC servers and clients that enable remote desktop viewing. The vulnerability allows for privilege escalation due to improper handling of memory in tigervnc. Red Hat has released an important security update (RHSA-2024:9901) for Red Hat Enterprise Linux 7 Extended Lifecycle Support to fix this issue by updating tigervnc to version 1.8.0-34.el7_9. The advisory covers multiple CPU architectures including x86_64, s390x, ppc64, and ppc64le. No CVSS score is provided in the advisory, but the severity is rated as important by Red Hat Product Security.

Successful exploitation of this heap-based buffer overflow vulnerability could allow an attacker to escalate privileges on affected Red Hat Enterprise Linux 7 Extended Lifecycle Support systems running tigervnc. This could lead to unauthorized administrative access. The advisory does not report any known exploits in the wild at this time.

Red Hat has released an official security update fixing this vulnerability in tigervnc for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Users should apply the update tigervnc-1.8.0-34.el7_9 and related packages as provided by Red Hat to remediate this issue. Refer to Red Hat article https://access.redhat.com/articles/11258 for detailed update instructions. No additional mitigation is required once the update is applied.