PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5581 Tigervnc CVE debrief

CVE-2017-5581 is a critical buffer overflow in TigerVNC’s ModifiablePixelBuffer::fillRect path. NVD describes the issue as reachable through an RRE message whose subrectangle lies outside framebuffer boundaries, with a CVSS 3.0 score of 9.8 and potential for remote code execution. The vulnerable range in the supplied NVD CPE data ends at TigerVNC 1.7, and the upstream release tag and patch references point to 1.7.1 as the fixed version.

Vendor
Tigervnc
Product
CVE-2017-5581
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-28
Original CVE updated
2026-05-13
Advisory published
2017-02-28
Advisory updated
2026-05-13

Who should care

Administrators, integrators, and end users running TigerVNC before 1.7.1 should treat this as urgent, especially where the software connects to untrusted VNC servers or is deployed in managed environments that may ingest externally controlled framebuffer data.

Technical summary

The flaw is a memory-safety bug (CWE-119) in ModifiablePixelBuffer::fillRect. According to NVD, a remote server can trigger the overflow by sending an RRE message with a subrectangle outside framebuffer boundaries. The published CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network reachability with no privileges or user interaction required and full confidentiality, integrity, and availability impact.

Defensive priority

Immediate remediation is recommended. This is a network-exploitable critical vulnerability with no required privileges or user interaction, and the supplied references indicate an upstream fix and 1.7.1 release are available.

Recommended defensive actions

  • Upgrade TigerVNC to 1.7.1 or later using the upstream release referenced in the corpus.
  • If an upgrade is not immediately possible, remove or restrict exposure of affected TigerVNC instances to trusted network paths only.
  • Prioritize patching hosts that connect to untrusted or externally supplied VNC servers.
  • Validate packaged or redistributed TigerVNC builds against the fixed upstream release and vendor advisories.
  • Use vendor and distro advisories in the corpus to confirm remediation status for your environment.

Evidence notes

The NVD record describes the overflow in ModifiablePixelBuffer::fillRect and the RRE subrectangle boundary condition. The supplied NVD metadata lists CVSS 3.0 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and CWE-119, and its CPE criteria mark TigerVNC versions through 1.7 as vulnerable. The corpus also includes the upstream patch commit, pull request, and the v1.7.1 release tag, plus Red Hat and Gentoo advisories as corroborating references. CVE publication time is taken from the supplied CVE published date, 2017-02-28.

Official resources

The CVE was published on 2017-02-28. The supplied references also include January 2017 mailing list and patch activity, and the upstream v1.7.1 release tag is included among the references. The NVD record was last modified on 2026-05-13 in,