CVE-2026-34352

In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an application crash, because of incorrect permissions.

CVSS v3 8.5 HIGH

8.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.5 / Impact : 5.3

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://github.com/TigerVNC/tigervnc/commit/0b5cab169d847789efa54459a87659d3fd484393	Patch
https://github.com/TigerVNC/tigervnc/issues/2079
https://groups.google.com/g/tigervnc-announce/c/anHL9WLshLI	Mailing List Patch
https://sourceforge.net/projects/tigervnc/files/stable/1.16.2	Release Notes
https://www.openwall.com/lists/oss-security/2026/03/26/7	Mailing List Third Party Advisory
https://github.com/TigerVNC/tigervnc/issues/2079

Configurations

Configuration 1 (hide)

cpe:2.3:a:tigervnc:tigervnc:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-26 23:16

Updated : 2026-06-17 10:38

NVD link : CVE-2026-34352

Mitre link : CVE-2026-34352

CVE.ORG link : CVE-2026-34352

JSON object : View

Products Affected

tigervnc

tigervnc

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2026-34352", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34352", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-04T14:56:55.844081Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.3, "exploitabilityScore": 2.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "TigerVNC", "product": "TigerVNC", "versions": [{"status": "affected", "version": "0", "lessThan": "1.16.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-03-26T23:16:20.903", "references": [{"url": "https://github.com/TigerVNC/tigervnc/commit/0b5cab169d847789efa54459a87659d3fd484393", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/TigerVNC/tigervnc/issues/2079", "source": "cve@mitre.org"}, {"url": "https://groups.google.com/g/tigervnc-announce/c/anHL9WLshLI", "tags": ["Mailing List", "Patch"], "source": "cve@mitre.org"}, {"url": "https://sourceforge.net/projects/tigervnc/files/stable/1.16.2", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://www.openwall.com/lists/oss-security/2026/03/26/7", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/TigerVNC/tigervnc/issues/2079", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an application crash, because of incorrect permissions."}, {"lang": "es", "value": "En TigerVNC anterior a 1.16.2, Image.cxx en x0vncserver permite a otros usuarios observar o manipular el contenido de la pantalla, o causar un fallo de la aplicaci\u00f3n, debido a permisos incorrectos."}], "lastModified": "2026-06-17T10:38:55.820", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tigervnc:tigervnc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A1D26886-0F31-44FB-8112-F07B18A7ACDA", "versionEndExcluding": "1.16.2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}