PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-10207 Tigervnc CVE debrief

CVE-2016-10207 is a remote denial-of-service issue in TigerVNC’s Xvnc server. According to NVD, an attacker can trigger invalid memory access and a crash by terminating a TLS handshake early. The issue is publicly recorded with CVSS 3.0 7.5 (High) and does not require authentication or user interaction.

Vendor
Tigervnc
Product
CVE-2016-10207
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-28
Original CVE updated
2026-05-13
Advisory published
2017-02-28
Advisory updated
2026-05-13

Who should care

Administrators and service owners running TigerVNC/Xvnc, especially systems exposing VNC over TLS and deployments that match NVD-listed TigerVNC versions or downstream vendor packages such as openSUSE and Red Hat builds.

Technical summary

NVD describes the flaw as an invalid memory access in the Xvnc server when a TLS handshake is ended prematurely. The record maps the weakness to CWE-119 and lists the impact as availability only (C:N/I:N/A:H). NVD’s vulnerable CPE criteria include TigerVNC 0.0.90, 0.0.91, 1.0, 1.0.1, 1.1.0, 1.3, 1.3.1, and 1.7, along with openSUSE Leap 42.1 and 42.2. The linked upstream TigerVNC commit and vendor advisories indicate a patched release path exists.

Defensive priority

High: this is a network-reachable, unauthenticated crash in a remote access service, so exposed VNC/TLS deployments should be prioritized for patching or containment.

Recommended defensive actions

  • Upgrade TigerVNC/Xvnc to a release that includes the upstream fix referenced by the linked TigerVNC patch commit, or install vendor packages that incorporate it.
  • Apply the relevant vendor advisories for your distribution, including the linked openSUSE and Red Hat security notices where applicable.
  • If immediate patching is not possible, restrict VNC/TLS exposure to trusted networks, VPNs, or bastion hosts.
  • Inventory fleets for the NVD-listed TigerVNC versions and downstream packages that may include the vulnerable code.
  • Monitor Xvnc service stability and investigate repeated crashes during TLS session setup as a sign of exposure.

Evidence notes

This debrief is based on the NVD CVE record, which supplies the vulnerability description, CVSS vector, CWE mapping, affected CPE criteria, and reference list. The reference set includes an upstream TigerVNC patch commit plus third-party vendor advisories from openSUSE, Red Hat, Gentoo, and security tracking references. No exploit code or reproduction steps are included here.

Official resources

Publicly published in the CVE/NVD record on 2017-02-28. The NVD record was later modified on 2026-05-13; that reflects record maintenance, not a new vulnerability date.