PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-10207 Tigervnc CVE debrief

CVE-2016-10207 is a remote denial-of-service issue in TigerVNC’s Xvnc server. According to NVD, an attacker can trigger invalid memory access and a crash by terminating a TLS handshake early. The issue is publicly recorded with CVSS 3.0 7.5 (High) and does not require authentication or user interaction.

Vendor
Tigervnc
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-28
Original CVE updated
2026-05-13
Advisory published
2017-02-28
Advisory updated
2026-05-13

Who should care

Administrators and service owners running TigerVNC/Xvnc, especially systems exposing VNC over TLS and deployments that match NVD-listed TigerVNC versions or downstream vendor packages such as openSUSE and Red Hat builds.

Technical summary

NVD describes the flaw as an invalid memory access in the Xvnc server when a TLS handshake is ended prematurely. The record maps the weakness to CWE-119 and lists the impact as availability only (C:N/I:N/A:H). NVD’s vulnerable CPE criteria include TigerVNC 0.0.90, 0.0.91, 1.0, 1.0.1, 1.1.0, 1.3, 1.3.1, and 1.7, along with openSUSE Leap 42.1 and 42.2. The linked upstream TigerVNC commit and vendor advisories indicate a patched release path exists.

Defensive priority

High: this is a network-reachable, unauthenticated crash in a remote access service, so exposed VNC/TLS deployments should be prioritized for patching or containment.

Recommended defensive actions

  • Upgrade TigerVNC/Xvnc to a release that includes the upstream fix referenced by the linked TigerVNC patch commit, or install vendor packages that incorporate it.
  • Apply the relevant vendor advisories for your distribution, including the linked openSUSE and Red Hat security notices where applicable.
  • If immediate patching is not possible, restrict VNC/TLS exposure to trusted networks, VPNs, or bastion hosts.
  • Inventory fleets for the NVD-listed TigerVNC versions and downstream packages that may include the vulnerable code.
  • Monitor Xvnc service stability and investigate repeated crashes during TLS session setup as a sign of exposure.

Evidence notes

This debrief is based on the NVD CVE record, which supplies the vulnerability description, CVSS vector, CWE mapping, affected CPE criteria, and reference list. The reference set includes an upstream TigerVNC patch commit plus third-party vendor advisories from openSUSE, Red Hat, Gentoo, and security tracking references. No exploit code or reproduction steps are included here.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-10207 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-10207

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-10207 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-10207

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.