Skip to content
Fencer Vulns
high 8.5

CVE-2026-34352 json

In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an applicatio…

published 2026-03-26 7 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-16468

cvss
8.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 16%
public exploits
0
none known

Summary

In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an application crash, because of incorrect permissions.

Patch / fix

  • TigerVNC TigerVNC 1.16.2
  • tigervnc Debian 13 1.15.0+dfsg-2.1~deb13u1
  • tigervnc Debian 14 1.15.0+dfsg-2.1

debian advisories DEBIAN-CVE-2026-34352

  • tigervnc RHEL 9 1.15.0-7.el9_8.1
  • tigervnc-icons RHEL 9 1.15.0-7.el9_8.1
  • tigervnc-server RHEL 9 1.15.0-7.el9_8.1
  • tigervnc-license RHEL 9 1.15.0-7.el9_8.1
  • tigervnc-selinux RHEL 9 1.15.0-7.el9_8.1
  • tigervnc-server-module RHEL 9 1.15.0-7.el9_8.1
  • tigervnc-server-minimal RHEL 9 1.15.0-7.el9_8.1
  • tigervnc RHEL 8 1.15.0-9.el8_10

red hat advisories RHSA-2026:24341RHSA-2026:23496RHSA-2026:23254RHSA-2026:23255RHSA-2026:22456RHSA-2026:22424

  • tigervnc SLE Module for Desktop Applications 15 SP7, SLE Module for Basesystem 15 SP7 1.14.1-150700.4.3.1
  • tigervnc SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +1 more 1.10.1-150400.7.15.1
  • tigervnc SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 1.12.0-150500.4.3.1
  • tigervnc SLES for SAP 15 SP6, SLES 15 SP6-LTSS, openSUSE Leap 15.6 1.13.1-150600.4.3.1
  • tigervnc SLES for SAP applications 16.0, SLES 16.0 1.15.0-160000.3.1
  • tigervnc SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 1.6.0-22.23.1

suse advisories SUSE-SU-2026:1360-1SUSE-SU-2026:1303-1SUSE-SU-2026:1302-1SUSE-SU-2026:1301-1SUSE-SU-2026:1252-1SUSE-SU-2026:21140-1

  • tigervnc openSUSE Leap 16.0 1.15.0-160000.3.1
  • tigervnc openSUSE Tumbleweed 1.16.1-2.1

opensuse advisories openSUSE-SU-2026:20465-1openSUSE-SU-2026:10470-1

  • tigervnc AlmaLinux 9 1.15.0-7.el9_8.1
  • tigervnc-icons AlmaLinux 9 1.15.0-7.el9_8.1
  • tigervnc-server AlmaLinux 9 1.15.0-7.el9_8.1
  • tigervnc-license AlmaLinux 9 1.15.0-7.el9_8.1
  • tigervnc-selinux AlmaLinux 9 1.15.0-7.el9_8.1
  • tigervnc-server-module AlmaLinux 9 1.15.0-7.el9_8.1
  • tigervnc-server-minimal AlmaLinux 9 1.15.0-7.el9_8.1
  • tigervnc AlmaLinux 8 1.15.0-9.el8_10

almalinux advisories ALSA-2026:19342ALSA-2026:13414ALSA-2026:10739

  • tigervnc Rocky Linux 9 1.15.0-7.el9_8.1
  • tigervnc Rocky Linux 8 1.15.0-9.el8_10
  • tigervnc Rocky Linux 9 1.15.0-6.el9_7.1

rocky linux advisories RLSA-2026:19342RLSA-2026:13414RLSA-2026:10739

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-34352 updated cvss 6.3

TigerVNC: x0vncserver: TigerVNC x0vncserver: Information disclosure, data manipulation, and denial of service via incorrect permissions

  • Red Hat Enterprise Linux AppStream (v. 8) tigervnc 1.15.0-9.el8_10, tigervnc-icons 1.15.0-9.el8_10, tigervnc-server 1.15.0-9.el8_10, tigervnc-license 1.15.0-9.el8_10, tigervnc-selinux 1.15.0-9.el8_10, tigervnc-server-module 1.15.0-9.el8_10, +1 more
    fixed: vendor fix RHSA-2026:13414
  • Red Hat Enterprise Linux AppStream (v. 9) tigervnc 1.15.0-6.el9_7.1, tigervnc 1.15.0-7.el9_8.1, tigervnc-icons 1.15.0-6.el9_7.1, tigervnc-icons 1.15.0-7.el9_8.1, tigervnc-server 1.15.0-6.el9_7.1, tigervnc-server 1.15.0-7.el9_8.1, +8 more
    fixed: vendor fix RHSA-2026:10739
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) tigervnc 1.11.0-8.el8_4.15, tigervnc-icons 1.11.0-8.el8_4.15, tigervnc-server 1.11.0-8.el8_4.15, tigervnc-license 1.11.0-8.el8_4.15, tigervnc-selinux 1.11.0-8.el8_4.15, tigervnc-server-module 1.11.0-8.el8_4.15, +1 more
    fixed: vendor fix RHSA-2026:23254
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) tigervnc 1.12.0-6.el8_6.17, tigervnc-icons 1.12.0-6.el8_6.17, tigervnc-server 1.12.0-6.el8_6.17, tigervnc-license 1.12.0-6.el8_6.17, tigervnc-selinux 1.12.0-6.el8_6.17, tigervnc-server-module 1.12.0-6.el8_6.17, +1 more
    fixed: vendor fix RHSA-2026:24341
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) tigervnc 1.12.0-15.el8_8.17, tigervnc-icons 1.12.0-15.el8_8.17, tigervnc-server 1.12.0-15.el8_8.17, tigervnc-license 1.12.0-15.el8_8.17, tigervnc-selinux 1.12.0-15.el8_8.17, tigervnc-server-module 1.12.0-15.el8_8.17, +1 more
    fixed: vendor fix RHSA-2026:23255
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) tigervnc 1.11.0-22.el9_0.17, tigervnc-icons 1.11.0-22.el9_0.17, tigervnc-server 1.11.0-22.el9_0.17, tigervnc-license 1.11.0-22.el9_0.17, tigervnc-selinux 1.11.0-22.el9_0.17, tigervnc-server-module 1.11.0-22.el9_0.17, +1 more
    fixed: vendor fix RHSA-2026:21741
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) tigervnc 1.12.0-14.el9_2.14, tigervnc-icons 1.12.0-14.el9_2.14, tigervnc-server 1.12.0-14.el9_2.14, tigervnc-license 1.12.0-14.el9_2.14, tigervnc-selinux 1.12.0-14.el9_2.14, tigervnc-server-module 1.12.0-14.el9_2.14, +1 more
    fixed: vendor fix RHSA-2026:20576
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) tigervnc 1.13.1-8.el9_4.9, tigervnc-icons 1.13.1-8.el9_4.9, tigervnc-server 1.13.1-8.el9_4.9, tigervnc-license 1.13.1-8.el9_4.9, tigervnc-selinux 1.13.1-8.el9_4.9, tigervnc-server-module 1.13.1-8.el9_4.9, +1 more
    fixed: vendor fix RHSA-2026:20575
show 8 more
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) tigervnc 1.14.1-10.el9_6, tigervnc-icons 1.14.1-10.el9_6, tigervnc-server 1.14.1-10.el9_6, tigervnc-license 1.14.1-10.el9_6, tigervnc-selinux 1.14.1-10.el9_6, tigervnc-server-module 1.14.1-10.el9_6, +1 more
    fixed: vendor fix RHSA-2026:22424
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) tigervnc 1.11.0-8.el8_4.15, tigervnc-icons 1.11.0-8.el8_4.15, tigervnc-server 1.11.0-8.el8_4.15, tigervnc-license 1.11.0-8.el8_4.15, tigervnc-selinux 1.11.0-8.el8_4.15, tigervnc-server-module 1.11.0-8.el8_4.15, +1 more
    fixed: vendor fix RHSA-2026:23254
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) tigervnc 1.12.0-6.el8_6.17, tigervnc-icons 1.12.0-6.el8_6.17, tigervnc-server 1.12.0-6.el8_6.17, tigervnc-license 1.12.0-6.el8_6.17, tigervnc-selinux 1.12.0-6.el8_6.17, tigervnc-server-module 1.12.0-6.el8_6.17, +1 more
    fixed: vendor fix RHSA-2026:24341
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) tigervnc 1.12.0-15.el8_8.17, tigervnc-icons 1.12.0-15.el8_8.17, tigervnc-server 1.12.0-15.el8_8.17, tigervnc-license 1.12.0-15.el8_8.17, tigervnc-selinux 1.12.0-15.el8_8.17, tigervnc-server-module 1.12.0-15.el8_8.17, +1 more
    fixed: vendor fix RHSA-2026:23255
  • Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) tigervnc 1.1.0-25.el6_10.16, tigervnc-server 1.1.0-25.el6_10.16
    fixed: vendor fix RHSA-2026:23496
  • Red Hat Enterprise Linux Server (v. 7 ELS) tigervnc 1.8.0-36.el7_9.4, tigervnc-icons 1.8.0-36.el7_9.4, tigervnc-server 1.8.0-36.el7_9.4, tigervnc-license 1.8.0-36.el7_9.4, tigervnc-server-minimal 1.8.0-36.el7_9.4
    fixed: vendor fix RHSA-2026:22456
  • Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION) tigervnc-server-applet 1.1.0-25.el6_10.16, tigervnc-server-module 1.1.0-25.el6_10.16
    fixed: vendor fix RHSA-2026:23496
  • Red Hat Enterprise Linux Server Optional (v. 7 ELS) tigervnc-server-applet 1.8.0-36.el7_9.4, tigervnc-server-module 1.8.0-36.el7_9.4
    fixed: vendor fix RHSA-2026:22456

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/TigerVNC/tigervnc/issues/2079 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • TigerVNC TigerVNC

Classification

Weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.