High
Security advisory
TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in TightDecoder::FilterGradient. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-15693
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:30 UTC · Revision 1
Source evidence
TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in TightDecoder::FilterGradient. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.
osv:CVE-2019-15693
Complete source record
{
"id": "1aef5e1dd519a669f0ef6352e17327f94a2cb9986dcb12e55a69fed785b685f4",
"url": "https://osv.dev/vulnerability/CVE-2019-15693",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-15693",
"summary": "TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in TightDecoder::FilterGradient. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.",
"evidence": "osv:CVE-2019-15693",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2019-15693",
"aliases": [
"CVE-2019-15693"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/cendioossman/tigervnc",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "b4ada8d0c6dac98c8b91fc64d112569a8ae5fb95"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"fixed": "b4ada8d0c6dac98c8b91fc64d112569a8ae5fb95"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v1.1.90",
"v0.0.90"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-15693.json",
"vanir_signatures": [
{
"id": "CVE-2019-15693-0778f897",
"digest": {
"length": 1114,
"function_hash": "161533384762656642991908016226820675801"
},
"source": "https://github.com/cendioossman/tigervnc/commit/b4ada8d0c6dac98c8b91fc64d112569a8ae5fb95",
"target": {
"file": "common/rfb/tightDecode.h",
"function": "TightDecoder::FilterGradient24"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-15693-0f28dc62",
"digest": {
"length": 1241,
"function_hash": "15078154590552314086322110788077167964"
},
"source": "https://github.com/cendioossman/tigervnc/commit/b4ada8d0c6dac98c8b91fc64d112569a8ae5fb95",
"target": {
"file": "common/rfb/tightDecode.h",
"function": "TightDecoder::FilterGradient"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-15693-88485049",
"digest": {
"threshold": 0.9,
"line_hashes": [
"293455449759008813589093370358687204021",
"325843735815826093212861249029613301064",
"136591138797822271697212927084004582351",
"62052450669799827691813475708858346363",
"337928664818970489339721796832910053544",
"93143391051428726767418149145675560953",
"317784546308526455607118808614036723427",
"128344201559584871911909258738499665899",
"177806965800441837721188648140893735849",
"112483111471243258414108181407805726649",
"339082532496385597166058674788704540274",
"45688700836358365768598936923207689267",
"142890125048347970355594432742912803847",
"54921379597364198587993663848271405886",
"8349089216622482553689210365120426753",
"119047859076443823313001192459542761695",
"128344201559584871911909258738499665899",
"329093963382497243144142375750350552265"
]
},
"source": "https://github.com/cendioossman/tigervnc/commit/b4ada8d0c6dac98c8b91fc64d112569a8ae5fb95",
"target": {
"file": "common/rfb/tightDecode.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:45:07Z"
}
},
{
"ranges": [
{
"repo": "https://github.com/tigervnc/tigervnc",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "4739493b635372bd40a34640a719f79fa90e4dba"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:tigervnc:tigervnc:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.10.1"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "4739493b635372bd40a34640a719f79fa90e4dba"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v1.10.1"
}
]
}
}
],
"versions": [
"v1.10.0",
"v1.9.90",
"v1.1.90",
"v0.0.90"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-15693.json"
}
}
],
"modified": "2026-10-20T13:45:07.488773210Z",
"provider": "osv",
"references": [
"https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1",
"https://github.com/CendioOssman/tigervnc/commit/b4ada8d0c6dac98c8b91fc64d112569a8ae5fb95",
"https://www.openwall.com/lists/oss-security/2019/12/20/2"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2019-15693",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388059,
"published_at": "2019-12-26T15:15:11.257+00:00"
}