ALSA-2026:28923: Security update for 7 packages

ALSA-2026:28923, released June 24, 2026, fixes 9 CVEs across 7 products. None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Highest CVSS

7.8

Base score, 0 to 10

Highest EPSS

0.0017

5th percentile

Priority of the 9 CVEs

Patch now 0
                                Urgent 0
                                High 9
                                Routine 0

Fixed package versions

Product	Release	Fixed in
tigervnc	almalinux 8	1.15.0-10.el8_10
tigervnc-icons	almalinux 8	1.15.0-10.el8_10
tigervnc-license	almalinux 8	1.15.0-10.el8_10
tigervnc-selinux	almalinux 8	1.15.0-10.el8_10
tigervnc-server	almalinux 8	1.15.0-10.el8_10
tigervnc-server-minimal	almalinux 8	1.15.0-10.el8_10
tigervnc-server-module	almalinux 8	1.15.0-10.el8_10

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2026-50259	Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb setmap request via mapwidths indexing	7.8	0.0017	None reported
High	CVE-2026-50258	Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb key types due to unchecked shift levels	7.8	0.0016	None reported
High	CVE-2026-50256	Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libxfont2 name length mismatch	7.8	0.0016	None reported
High	CVE-2026-50260	Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in freecounter()	7.8	0.0015	None reported
High	CVE-2026-50261	Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in syncchangecounter()	7.8	0.0015	None reported
High	CVE-2026-50264	xorg-server: An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat	7.8	0.0015	None reported
High	CVE-2026-50257	Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence()	7.8	0.0014	None reported
High	CVE-2026-50263	Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free information disclosure in createsaverwindow()	7.8	0.0014	None reported
High	CVE-2026-50262	Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds read/write in glx changedrawableattributes	7.8	0.0013	None reported

Also fixes CVE-2026-50259

ELSA-2026-26566
xorg-x11-server-Xwayland, xorg-x11-server-Xwayland-devel on ol 10
RHSA-2026:29844
tigervnc, tigervnc-icons, tigervnc-license and 4 more on RHEL 9
RLSA-2026:29844
tigervnc on rocky 9
RHSA-2026:28923
tigervnc, tigervnc-icons, tigervnc-license and 4 more on RHEL 8
RLSA-2026:28923
tigervnc on rocky 8
ALSA-2026:29844
tigervnc, tigervnc-icons, tigervnc-license and 4 more on almalinux 9
ELSA-2026-29844
tigervnc, tigervnc-icons, tigervnc-license and 4 more on ol 9
RHSA-2026:26590
xorg-x11-server-Xwayland, xorg-x11-server-Xwayland-devel on RHEL 9

Vendor advisory

https://osv.dev/vulnerability/ALSA-2026:28923

For tools and AI agents

This page as data: JSON · Markdown

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.