Tigervnc Vulnerability: Info Disclosure, File Manipulation, DoS

CERT-Bund has released advisory WID-SEC-2026-0888 concerning critical vulnerabilities in Tigervnc, an open-source VNC implementation. The advisory highlights that a local attacker can exploit these flaws to disclose information, manipulate files, and cause a denial of service. The affected product is Open Source Tigervnc versions prior to 1.16.2, running on Linux, UNIX, and Windows operating systems. The CVSS Base Score is rated at 8.5 (High).

This advisory indicates a significant security risk for users of affected Tigervnc installations. While the advisory does not specify a compliance deadline, it strongly suggests that users should mitigate the risk by updating to a patched version or implementing other security measures to prevent exploitation. The advisory notes that mitigation is available, implying that a fix or workaround exists, and users should seek this information to protect their systems from potential attacks.