CVE-2014-8241

XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer...

9.8 CriticalFix available

XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer dereference) by leveraging failure to check a malloc return value, a similar issue to CVE-2014-6052.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

3.06%Up 2.0 points since Feb 4, 2022

What each source reports

NVD Score used 9.8

XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer dereference) by leveraging failure to check a malloc return value, a similar issue to CVE-2014-6052.

Record: CVE-2014-8241
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-476
Updated: 2026-11-02

CVE List No score

XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer dereference) by leveraging failure to check a malloc return value, a similar issue to CVE-2014-6052.

Record: CVE-2014-8241
Updated: 2026-11-02

EUVDEUVD-2014-8082 No score

XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer dereference) by leveraging failure to check a malloc return value, a similar issue to CVE-2014-6052.

Record: EUVD-2014-8082
Updated: 2026-11-03

GitHub AdvisoriesGHSA-gq2g-qwmw-m5q3 9.8

XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer...

XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer dereference) by leveraging failure to check a malloc return value, a similar issue to CVE-2014-6052.

Record: GHSA-gq2g-qwmw-m5q3
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-476
Updated: 2026-11-02

OSV 9.8

XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer dereference) by leveraging failure to check a malloc return value, a similar issue to CVE-2014-6052.

Record: CVE-2014-8241
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-8241 9.8

XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer dereference) by leveraging failure to check a malloc return value, a similar issue to CVE-2014-6052.

Record: DEBIAN-CVE-2014-8241
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2015-0459 No score

Updated tigervnc packages fix security vulnerabilities

Updated tigervnc packages fix security vulnerabilities:

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way TigerVNC handled screen sizes. A malicious VNC server could use this flaw to cause a client to crash or, potentially, execute arbitrary code on the client (CVE-2014-8240).

A NULL pointer dereference flaw was found in TigerVNC's XRegion. A malicious VNC server could use this flaw to cause a client to crash (CVE-2014-8241).

Record: MGASA-2015-0459
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`tigervnc` Debian:12	before 1.7.0-2	1.7.0-2
`tigervnc` Debian:13	before 1.7.0-2	1.7.0-2
`tigervnc` Debian:14	before 1.7.0-2	1.7.0-2
`tigervnc` Mageia:5 From an advisory covering 2 CVEs	before 1.3.1-6.1.mga5	1.3.1-6.1.mga5
`tigervnc-debuginfo` Red Hat:enterprise_linux:7::client From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc-server-applet` Red Hat:enterprise_linux:7::client From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc-server-module` Red Hat:enterprise_linux:7::client From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc` Red Hat:enterprise_linux:7::client From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc-icons` Red Hat:enterprise_linux:7::client From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc-license` Red Hat:enterprise_linux:7::client From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7

Show 26 moreShow less

Affected packages
Package	Affected	Fixed
`tigervnc-server` Red Hat:enterprise_linux:7::client From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc-server-minimal` Red Hat:enterprise_linux:7::client From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc` Red Hat:enterprise_linux:7::computenode From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc-debuginfo` Red Hat:enterprise_linux:7::computenode From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc-icons` Red Hat:enterprise_linux:7::computenode From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc-server` Red Hat:enterprise_linux:7::computenode From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc-server-applet` Red Hat:enterprise_linux:7::computenode From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc-server-module` Red Hat:enterprise_linux:7::computenode From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc-license` Red Hat:enterprise_linux:7::computenode From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc-server-minimal` Red Hat:enterprise_linux:7::computenode From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc-debuginfo` Red Hat:enterprise_linux:7::server From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc-server-applet` Red Hat:enterprise_linux:7::server From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc-server-module` Red Hat:enterprise_linux:7::server From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc` Red Hat:enterprise_linux:7::server From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc-icons` Red Hat:enterprise_linux:7::server From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc-license` Red Hat:enterprise_linux:7::server From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc-server` Red Hat:enterprise_linux:7::server From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc-server-minimal` Red Hat:enterprise_linux:7::server From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc-debuginfo` Red Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc-server-applet` Red Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc-server-module` Red Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc` Red Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc-icons` Red Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc-license` Red Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc-server` Red Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7
`tigervnc-server-minimal` Red Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs	before 0:1.3.1-3.el7	0:1.3.1-3.el7

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-8241 is a critical vulnerability (CVSS 9.8) in Tigervnc, published November 26, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.06%, the 87th percentile. Fixed in tigervnc 1.7.0-2.

References

Show 23 moreShow less