CVE-2026-34352 is a high severity (CVSS 8.5) permissions flaw in x0vncserver, part of TigerVNC before 1.16.2. Other users on the machine can observe or manipulate the screen. Upgrade to 1.16.2, because the 1.16.1 release shipped without the security fix. Check hosts that share a desktop.
What's affected
The record says TigerVNC before 1.16.2, in Image.cxx of x0vncserver. The project announced that 1.16.1 was meant as a security release, then published 1.16.2 the next day, saying 1.16.1 had all the fixes except the security fix. Skip 1.16.1.
The vector is local: the attacker needs an account on the same machine. The fix, shown in the project's commit, tightens the permissions on a shared memory segment so other users cannot attach to it.
How to check if you're exposed
See which version is installed through your package manager, for example rpm -q tigervnc-server or dpkg -l | grep tigervnc. A version below 1.16.2 is affected, subject to distribution backports.
Then check whether x0vncserver is used at all. It shares an existing X display, unlike the virtual desktop servers. Multi-user machines that run it are the risk.
What to do now
- Find hosts that run x0vncserver.
- Upgrade to TigerVNC 1.16.2 or the distribution's patched package.
- Stop x0vncserver on shared machines until the upgrade is done.
- Limit who has local accounts on hosts that expose a screen through VNC.
Why it matters
The weakness is CWE-732, incorrect permission assignment for a critical resource. The shared memory used to hold screen contents was created with permissions that let any local user open it.
On a shared server, that means one user can watch or change another user's desktop. The record does not mark it as exploited, and it is not on the CISA KEV list.
Quick check
Why not use 1.16.1?
The project says that release did not include the security fix. Use 1.16.2.
Sources
Last reviewed: 19 October 2026.
