CVE Feed

    Dashboard / CVE / CVE-2014-0011

    CVE-2014-0011

    Multiple heap-based buffer overflows in the ZRLE_DECODE function in common/rfb/zrleDecode.h in TigerVNC before 1.3.1, when NDEBUG is enabled, allow remote VNC servers to cause a denial of service (vncviewer crash) and possibly execute arbitrary code via vectors related to screen image rendering.

    Published:Mar 19, 2014
    Last Modified:Nov 21, 2024
    EPS:Jan 2, 2020
    EPSS Score:0.00549
    CVSS Score:9.8

    Affected Products

    Vendor
    Tigervnc
    Product
    Tigervnc

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-92 Forced Integer Overflow

    Related CVEs

    CVE-2026-34352 (CVSS 8.5) — In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen con…
    CVE-2025-26594 (CVSS 7.8) — A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a glob…
    CVE-2025-26599 (CVSS 7.8) — An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() m…
    CVE-2025-26601 (CVSS 7.8) — A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask a…
    CVE-2025-26595 (CVSS 7.8) — A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized …
    CVE-2025-26597 (CVSS 7.8) — A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey() is called with a 0 group, it …
    CVE-2025-26598 (CVSS 7.8) — An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the …
    CVE-2025-26600 (CVSS 7.8) — A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events…
    CVE-2025-26596 (CVSS 7.8) — A heap overflow flaw was found in X.Org and Xwayland. The computation of the length in XkbSizeKeySyms() differ…
    CVE-2024-0408 (CVSS 5.5) — A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffe…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High