CVE-2020-26117: Debian Linux

High severity, CVSS 8.1. EPSS: 3.1% chance of exploitation in the next 30 days.

In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception.

Affected products

• Debian Debian Linux: version 9.0 only
• Opensuse Leap: version 15.2 only
• Tigervnc Tigervnc: before 1.11.0 (fixed in 1.11.0)

Published 2020-09-27. Last modified 2026-06-17.