Vulnerability · Published Mar 26, 2026 · Assigned by mitre
CVE-2026-34352
High 8.5
In plain English
A high-severity incorrect permission assignment in TigerVNC from TigerVNC. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.5High
Exploit odds (30 days)0.3%top 83.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an application crash, because of incorrect permissions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | tigervnc | 1.15.0-9.el8_10 | ALSA-2026:13414 |
| AlmaLinux:9 | tigervnc | 1.15.0-6.el9_7.1 | ALSA-2026:10739 |
| AlmaLinux:9 | tigervnc | 1.15.0-7.el9_8.1 | ALSA-2026:19342 |
| AlmaLinux:8 | tigervnc-icons | 1.15.0-9.el8_10 | ALSA-2026:13414 |
| AlmaLinux:9 | tigervnc-icons | 1.15.0-7.el9_8.1 | ALSA-2026:19342 |
| AlmaLinux:9 | tigervnc-icons | 1.15.0-6.el9_7.1 | ALSA-2026:10739 |
| AlmaLinux:8 | tigervnc-license | 1.15.0-9.el8_10 | ALSA-2026:13414 |
| AlmaLinux:9 | tigervnc-license | 1.15.0-7.el9_8.1 | ALSA-2026:19342 |
| AlmaLinux:9 | tigervnc-license | 1.15.0-6.el9_7.1 | ALSA-2026:10739 |
| AlmaLinux:8 | tigervnc-selinux | 1.15.0-9.el8_10 | ALSA-2026:13414 |
| AlmaLinux:9 | tigervnc-selinux | 1.15.0-7.el9_8.1 | ALSA-2026:19342 |
| AlmaLinux:9 | tigervnc-selinux | 1.15.0-6.el9_7.1 | ALSA-2026:10739 |
| AlmaLinux:8 | tigervnc-server | 1.15.0-9.el8_10 | ALSA-2026:13414 |
| AlmaLinux:9 | tigervnc-server | 1.15.0-6.el9_7.1 | ALSA-2026:10739 |
| AlmaLinux:9 | tigervnc-server | 1.15.0-7.el9_8.1 | ALSA-2026:19342 |
| AlmaLinux:8 | tigervnc-server-minimal | 1.15.0-9.el8_10 | ALSA-2026:13414 |
| AlmaLinux:9 | tigervnc-server-minimal | 1.15.0-6.el9_7.1 | ALSA-2026:10739 |
| AlmaLinux:9 | tigervnc-server-minimal | 1.15.0-7.el9_8.1 | ALSA-2026:19342 |
| AlmaLinux:8 | tigervnc-server-module | 1.15.0-9.el8_10 | ALSA-2026:13414 |
| AlmaLinux:9 | tigervnc-server-module | 1.15.0-6.el9_7.1 | ALSA-2026:10739 |
| AlmaLinux:9 | tigervnc-server-module | 1.15.0-7.el9_8.1 | ALSA-2026:19342 |
| Debian:12 | tigervnc | no fix listed | DEBIAN-CVE-2026-34352 |
| Debian:13 | tigervnc | 1.15.0+dfsg-2.1~deb13u1 | DEBIAN-CVE-2026-34352 |
| Debian:14 | tigervnc | 1.15.0+dfsg-2.1 | DEBIAN-CVE-2026-34352 |
| Rocky Linux:8 | tigervnc | 0:1.15.0-9.el8_10 | RLSA-2026:13414 |
| Rocky Linux:9 | tigervnc | 0:1.15.0-6.el9_7.1 | RLSA-2026:10739 |
| Rocky Linux:9 | tigervnc | 0:1.15.0-7.el9_8.1 | RLSA-2026:19342 |
| Ubuntu:22.04:LTS | tigervnc | no fix listed | UBUNTU-CVE-2026-34352 |
| Ubuntu:24.04:LTS | tigervnc | no fix listed | UBUNTU-CVE-2026-34352 |
| Ubuntu:25.10 | tigervnc | no fix listed | UBUNTU-CVE-2026-34352 |
| Ubuntu:26.04:LTS | tigervnc | no fix listed | UBUNTU-CVE-2026-34352 |
| Ubuntu:26.10 | tigervnc | no fix listed | UBUNTU-CVE-2026-34352 |
Affected products (as reported)
Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L
References
- https://www.openwall.com/lists/oss-security/2026/03/26/7
- https://github.com/TigerVNC/tigervnc/commit/0b5cab169d847789efa54459a87659d3fd484393
- https://sourceforge.net/projects/tigervnc/files/stable/1.16.2
- https://groups.google.com/g/tigervnc-announce/c/anHL9WLshLI
- https://github.com/TigerVNC/tigervnc/issues/2079