USN-9088-1: TigerVNC vulnerability
Publication date
12 November 2026
Overview
TigerVNC could be made to expose sensitive information over the network.
Releases
Packages
- tigervnc - Virtual network computing server and client
Details
It was discovered that the TigerVNC viewer stored TLS certificate
exceptions as trusted certificate authorities. A remote attacker could
possibly use this issue to impersonate any VNC server after a user had
added a certificate exception for the attacker's server.
It was discovered that the TigerVNC viewer stored TLS certificate
exceptions as trusted certificate authorities. A remote attacker could
possibly use this issue to impersonate any VNC server after a user had
added a certificate exception for the attacker's server.
Update instructions
In general, a standard system update will make all the necessary changes.
Learn more about how to get the fixes.The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 18.04 LTS bionic | tigervnc-common – 1.7.0+dfsg-8ubuntu2+esm1 | ||
| tigervnc-scraping-server – 1.7.0+dfsg-8ubuntu2+esm1 | |||
| tigervnc-standalone-server – 1.7.0+dfsg-8ubuntu2+esm1 | |||
| tigervnc-viewer – 1.7.0+dfsg-8ubuntu2+esm1 | |||
| tigervnc-xorg-extension – 1.7.0+dfsg-8ubuntu2+esm1 | |||
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.