TigerVNC Vulnerability — Ubuntu Security Update (USN-9088-1)
USN-9088-1 updates Ubuntu 20.04, Ubuntu 22.04: It was discovered that the TigerVNC viewer stored TLS certificate exceptions as trusted certificate authorities. Apply the update via standard apt tooling.
What this means under a SharedLicense license
The advisory's own severity data peaks at CVSS ; unpatched Ubuntu 20.04, Ubuntu 22.04 servers remain exposed until updated.
-
USN-9088-1
Publication date
12 November 2026
Overview
TigerVNC could be made to expose sensitive information over the network.
Releases
Packages
- tigervnc – Virtual network computing server and client
Details
It was discovered that the TigerVNC viewer stored TLS certificate
exceptions as trusted certificate authorities. A remote attacker could
possibly use this issue to impersonate any VNC server after a user had
added a certificate exception for the attacker’s server.
It was discovered that the TigerVNC viewer stored TLS certificate
exceptions as trusted certificate authorities. A remote attacker could
possibly use this issue to impersonate any VNC server after a user had
added a certificate exception for the attacker’s server.
Update instructions
In general, a standard system update will make all the necessary changes.
Learn more about how to get the fixes.
The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 18.04 LTS bionic | tigervnc-common – 1.7.0+dfsg-8ubuntu2+esm1 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. | ||
| tigervnc-scraping-server – 1.7.0+dfsg-8ubuntu2+esm1 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. | |||
| tigervnc-standalone-server – 1.7.0+dfsg-8ubuntu2+esm1 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. | |||
| tigervnc-viewer – 1.7.0+dfsg-8ubuntu2+esm1 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. | |||
| tigervnc-xorg-extension – 1.7.0+dfsg-8ubuntu2+esm1 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future. | |||
References
Related notices
Frequently Asked Questions
What does USN-9088-1 fix?
Which Ubuntu releases are covered?
How do I apply it?
Check your system for vulnerabilities
Select your product and operating system to see the exact fix commands that apply to you.
Check Your System