VULNERABILITY INTELLIGENCE

CVE-2019-15691

CVSS score7.2 HIGH

EPSS probability4.72%

CISA KEVNot currently listed

Published2019-12-26

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoder. If decoding routine would throw an exception, ZRLEDecoder may try to access stack variable, which has been already freed during the process of stack unwinding. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.

Weakness classification

vulnerability@kaspersky.com: CWE-825
nvd@nist.gov: CWE-672

Primary references

vulnerability@kaspersky.com — Third Party Advisory
vulnerability@kaspersky.com — Patch, Third Party Advisory
vulnerability@kaspersky.com — Release Notes, Third Party Advisory
vulnerability@kaspersky.com — Exploit, Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Mailing List, Third Party Advisory