Red Hat Product Errata RHSA-2026:98538 - Security Advisory
Issued:
2026-11-11
Updated:
2026-11-11

RHSA-2026:98538 - Security Advisory

Synopsis

Important: tigervnc security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for tigervnc is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients.

Security Fix(es):

  • xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)
  • xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521)
  • xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812)
  • xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523)
  • xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517)
  • xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518)
  • xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519)
  • xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64

Fixes

  • BZ - 2545161 - CVE-2026-93516 xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling
  • BZ - 2545164 - CVE-2026-93521 xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests
  • BZ - 2545174 - CVE-2026-88812 xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling
  • BZ - 2545177 - CVE-2026-93523 xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice
  • BZ - 2545246 - CVE-2026-93517 xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow
  • BZ - 2545860 - CVE-2026-93518 xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize
  • BZ - 2545887 - CVE-2026-93519 xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor()
  • BZ - 2545908 - CVE-2026-93520 xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling

Red Hat Enterprise Linux for x86_64 9

SRPM
tigervnc-1.16.2-4.el9_9.1.src.rpm SHA-256: 5d9e456ab900ca9e0df89be276c942f7a0d128db933de05e7bfddbad354a55ad
x86_64
tigervnc-1.16.2-4.el9_9.1.x86_64.rpm SHA-256: 309ed977720b2a69d97a0ed6d1d8302164372d9cec5ef5ef8f70fb0329b0e575
tigervnc-debuginfo-1.16.2-4.el9_9.1.x86_64.rpm SHA-256: 67853055cca62c0cf06b2a622a079bd55242be0b4db7831ed9833bc195162619
tigervnc-debugsource-1.16.2-4.el9_9.1.x86_64.rpm SHA-256: 1a168660b33132f73aadc2a3b3655db04025756e278af72bf138b034dd0649c8
tigervnc-icons-1.16.2-4.el9_9.1.noarch.rpm SHA-256: 7ab992ed3b0b129a53b22c23c4856c2bcb47f5a292d239d49e65a6f0ca6b0661
tigervnc-license-1.16.2-4.el9_9.1.noarch.rpm SHA-256: d0464b2ba26a11359b294a5aa8924eaf205788e87d1bdfc9507c1bf095fff4ba
tigervnc-selinux-1.16.2-4.el9_9.1.noarch.rpm SHA-256: cd56b08127499784ae696c500415c1b7f1be0ba25dec50ee49309aa0937805c1
tigervnc-server-1.16.2-4.el9_9.1.x86_64.rpm SHA-256: 9b42959b5de3bec326f77928ecd064e4941a3a41d8deca2c8da76ca23e44b93b
tigervnc-server-debuginfo-1.16.2-4.el9_9.1.x86_64.rpm SHA-256: 016690fbf3c8ea253b354e8066c3e3c7e36f8cfce072162dd8273ad9a8712b66
tigervnc-server-minimal-1.16.2-4.el9_9.1.x86_64.rpm SHA-256: 216588601b0b0c813643792e09adefeefc5748d47fbe123af1396a9c41d5322a
tigervnc-server-minimal-debuginfo-1.16.2-4.el9_9.1.x86_64.rpm SHA-256: adb78312ca216e34f50a104c4787c9fd67dee8459d1887a912aef6e0cd7832ba
tigervnc-server-module-1.16.2-4.el9_9.1.x86_64.rpm SHA-256: 385384edc93fd69137cf678900e8dd9db776e21c83a6df014b702aae3a20cc02
tigervnc-server-module-debuginfo-1.16.2-4.el9_9.1.x86_64.rpm SHA-256: 263cec16e2b33744f42e8da65f3e8b680f8e1dfc6b9bbd3e1d1178b3adcd3c71

Red Hat Enterprise Linux for IBM z Systems 9

SRPM
tigervnc-1.16.2-4.el9_9.1.src.rpm SHA-256: 5d9e456ab900ca9e0df89be276c942f7a0d128db933de05e7bfddbad354a55ad
s390x
tigervnc-1.16.2-4.el9_9.1.s390x.rpm SHA-256: b0fc5a20be0f379f4efe7f890107dc5eeb2e05386b7bc4747be61b41f465ab11
tigervnc-debuginfo-1.16.2-4.el9_9.1.s390x.rpm SHA-256: 11b804d16557afb09858b2b0c36e7fb9ee67865a19ac8316a6e36ae2da384099
tigervnc-debugsource-1.16.2-4.el9_9.1.s390x.rpm SHA-256: 934a5f13ac2acdf2ec5f8348c31b18babf527aba1de5a2cd3999e0547c2a8718
tigervnc-icons-1.16.2-4.el9_9.1.noarch.rpm SHA-256: 7ab992ed3b0b129a53b22c23c4856c2bcb47f5a292d239d49e65a6f0ca6b0661
tigervnc-license-1.16.2-4.el9_9.1.noarch.rpm SHA-256: d0464b2ba26a11359b294a5aa8924eaf205788e87d1bdfc9507c1bf095fff4ba
tigervnc-selinux-1.16.2-4.el9_9.1.noarch.rpm SHA-256: cd56b08127499784ae696c500415c1b7f1be0ba25dec50ee49309aa0937805c1
tigervnc-server-1.16.2-4.el9_9.1.s390x.rpm SHA-256: bba7e07bbccae620b4dc25612acf0ead29d3230e040a8d26cf546338ff6ac983
tigervnc-server-debuginfo-1.16.2-4.el9_9.1.s390x.rpm SHA-256: a54cb4363ab9a3fb24746ebde7e92aaf5768a52dc7aebd2dffe6577084f2fa4d
tigervnc-server-minimal-1.16.2-4.el9_9.1.s390x.rpm SHA-256: aec3864f48ca8c05b7fdf442018ec8303db9dd619a28d00a292e23097c3d3156
tigervnc-server-minimal-debuginfo-1.16.2-4.el9_9.1.s390x.rpm SHA-256: 7778705b6a9ac092632ead070df5501ff86000796b42f23374b6af7e5e42d82e
tigervnc-server-module-1.16.2-4.el9_9.1.s390x.rpm SHA-256: 2b7c6dd060c801988a14d4acd55f4dd36e83a34f808ec3a99ccbfd0a262fd6f0
tigervnc-server-module-debuginfo-1.16.2-4.el9_9.1.s390x.rpm SHA-256: 6be445c5f3e77c3c2a4470b581769842b213d6e5693b6766ee642dc98666e336

Red Hat Enterprise Linux for Power, little endian 9

SRPM
tigervnc-1.16.2-4.el9_9.1.src.rpm SHA-256: 5d9e456ab900ca9e0df89be276c942f7a0d128db933de05e7bfddbad354a55ad
ppc64le
tigervnc-1.16.2-4.el9_9.1.ppc64le.rpm SHA-256: 71633fc3055f60672d1a54ab6d130c5d12752065a037f03748fbd1170c22a554
tigervnc-debuginfo-1.16.2-4.el9_9.1.ppc64le.rpm SHA-256: 6aacccf4be02fc005ad237cbca5ba116c3ae22343176c2f9eb96f7f7c4d29913
tigervnc-debugsource-1.16.2-4.el9_9.1.ppc64le.rpm SHA-256: 65586618fb2cd857e6c0aae8aeaacae94d96cb96502646fb9e45dcc109578f2a
tigervnc-icons-1.16.2-4.el9_9.1.noarch.rpm SHA-256: 7ab992ed3b0b129a53b22c23c4856c2bcb47f5a292d239d49e65a6f0ca6b0661
tigervnc-license-1.16.2-4.el9_9.1.noarch.rpm SHA-256: d0464b2ba26a11359b294a5aa8924eaf205788e87d1bdfc9507c1bf095fff4ba
tigervnc-selinux-1.16.2-4.el9_9.1.noarch.rpm SHA-256: cd56b08127499784ae696c500415c1b7f1be0ba25dec50ee49309aa0937805c1
tigervnc-server-1.16.2-4.el9_9.1.ppc64le.rpm SHA-256: 223f761b4c5f90066944f037894482fff220c38302a7281702274c8332b94886
tigervnc-server-debuginfo-1.16.2-4.el9_9.1.ppc64le.rpm SHA-256: e64c3ad35f6365bff4f4f3ba1938c04850e981cd673573baf9da403b5d0fecb0
tigervnc-server-minimal-1.16.2-4.el9_9.1.ppc64le.rpm SHA-256: f1941e5a3271de7c656cfaf85b9364f729baa0aad62e1ce0a496fe90f683c936
tigervnc-server-minimal-debuginfo-1.16.2-4.el9_9.1.ppc64le.rpm SHA-256: 322e86cc1e2cf1e9531864e271b1529e60fe7204e202b3e4aa9e9581d6427340
tigervnc-server-module-1.16.2-4.el9_9.1.ppc64le.rpm SHA-256: 3fb8b7d7527c9581867867e3ac93a0920a01de1a695d3ad94b61e5fd23579d8a
tigervnc-server-module-debuginfo-1.16.2-4.el9_9.1.ppc64le.rpm SHA-256: 4bd6682ec25c3e26511e31242a0192e5c6f2e0a18d6663d7ea886c1a837dfa55

Red Hat Enterprise Linux for ARM 64 9

SRPM
tigervnc-1.16.2-4.el9_9.1.src.rpm SHA-256: 5d9e456ab900ca9e0df89be276c942f7a0d128db933de05e7bfddbad354a55ad
aarch64
tigervnc-1.16.2-4.el9_9.1.aarch64.rpm SHA-256: 630b5612e88655910e68e885a324cff3f40cb242a1c3c525b9c039d6cb83ba89
tigervnc-debuginfo-1.16.2-4.el9_9.1.aarch64.rpm SHA-256: 477585e1d6cabbc369bd816940539fc34eeb66bbc11bb0fab634280f916b3b44
tigervnc-debugsource-1.16.2-4.el9_9.1.aarch64.rpm SHA-256: 8a596e9f6cd506594eb52c1124d221b710a665489e523653cef77f512bdf4316
tigervnc-icons-1.16.2-4.el9_9.1.noarch.rpm SHA-256: 7ab992ed3b0b129a53b22c23c4856c2bcb47f5a292d239d49e65a6f0ca6b0661
tigervnc-license-1.16.2-4.el9_9.1.noarch.rpm SHA-256: d0464b2ba26a11359b294a5aa8924eaf205788e87d1bdfc9507c1bf095fff4ba
tigervnc-selinux-1.16.2-4.el9_9.1.noarch.rpm SHA-256: cd56b08127499784ae696c500415c1b7f1be0ba25dec50ee49309aa0937805c1
tigervnc-server-1.16.2-4.el9_9.1.aarch64.rpm SHA-256: 81538b5c14774fd5225d96bbfac9f4bf456989c15701f2de07cb46aa6f3f0a17
tigervnc-server-debuginfo-1.16.2-4.el9_9.1.aarch64.rpm SHA-256: 3c124177524607f4aae723ab345cb69552e3f4ef6af64e9e4d5622dd46b0d175
tigervnc-server-minimal-1.16.2-4.el9_9.1.aarch64.rpm SHA-256: aade0c4823fc4d19ac8bdbd2ca56492fae3724217bc506af6d38c7d4fddc5f89
tigervnc-server-minimal-debuginfo-1.16.2-4.el9_9.1.aarch64.rpm SHA-256: 9c2c2f5142ce1da0c576af8539af00758d26c5880d221236be897952875ee034
tigervnc-server-module-1.16.2-4.el9_9.1.aarch64.rpm SHA-256: bbefabc2e50a610bf428487b67cb150c1382c52413c4bfbad6436fd772696ae6
tigervnc-server-module-debuginfo-1.16.2-4.el9_9.1.aarch64.rpm SHA-256: 08a9b46ec098a86edb6bf5828a94ac254021cb8ee0a0899f183508dfd0ebc93b

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.