Read the docs
TI-2026-26639 Aliases CVE-2026-34352GHSA-4vj5-vh2w-8g5j

Incorrect permission assignment in TigerVNC

Priority HIGH 75CWE-732Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an application crash, because of incorrect permissions.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00251 16th percentileScored 2026-11-07
Fix Fixed TigerVNC (TigerVNC): 1.16.2Red Hat: 12 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TigerVNCTigerVNCbefore 1.16.21.16.2Patch availableCNA
  • TigerVNC VendorTigerVNC Affected before 1.16.2 Fixed in 1.16.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:tigervnc:tigervnc:*:*:*:*:*:*:*:*before 1.16.2VulnerableTigerVNC
  • cpe:2.3:a:tigervnc:tigervnc:*:*:*:*:*:*:*:* Versions before 1.16.2 Vulnerable ·TigerVNC

Remediation

  • Fix · CNA TigerVNC (TigerVNC) Fixed in 1.16.2

Red Hat 12 advisories

  • RHSA-2026:24341 Released 2026-06-08 · Red Hat rating Important
    tigervnc security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) tigervnc-1.12.0-6.el8_6.17, tigervnc-icons-1.12.0-6.el8_6.17, tigervnc-license-1.12.0-6.el8_6.17 +4
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) tigervnc-1.12.0-6.el8_6.17, tigervnc-icons-1.12.0-6.el8_6.17, tigervnc-license-1.12.0-6.el8_6.17 +4
  • RHSA-2026:23496 Released 2026-06-04 · Red Hat rating Important
    tigervnc security update
    • Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) tigervnc-1.1.0-25.el6_10.16, tigervnc-server-1.1.0-25.el6_10.16
    • Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION) tigervnc-server-applet-1.1.0-25.el6_10.16, tigervnc-server-module-1.1.0-25.el6_10.16
  • RHSA-2026:23255 Released 2026-06-04 · Red Hat rating Important
    tigervnc security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) tigervnc-1.12.0-15.el8_8.17, tigervnc-icons-1.12.0-15.el8_8.17, tigervnc-license-1.12.0-15.el8_8.17 +4
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) tigervnc-1.12.0-15.el8_8.17, tigervnc-icons-1.12.0-15.el8_8.17, tigervnc-license-1.12.0-15.el8_8.17 +4
Show 9 more Red Hat advisories
  • RHSA-2026:23254 Released 2026-06-04 · Red Hat rating Important
    tigervnc security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) tigervnc-1.11.0-8.el8_4.15, tigervnc-icons-1.11.0-8.el8_4.15, tigervnc-license-1.11.0-8.el8_4.15 +4
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) tigervnc-1.11.0-8.el8_4.15, tigervnc-icons-1.11.0-8.el8_4.15, tigervnc-license-1.11.0-8.el8_4.15 +4
  • RHSA-2026:22456 Released 2026-06-02 · Red Hat rating Important
    tigervnc security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) tigervnc-1.8.0-36.el7_9.4, tigervnc-icons-1.8.0-36.el7_9.4, tigervnc-license-1.8.0-36.el7_9.4 +2
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) tigervnc-server-applet-1.8.0-36.el7_9.4, tigervnc-server-module-1.8.0-36.el7_9.4
  • RHSA-2026:22424 Released 2026-06-02 · Red Hat rating Important
    tigervnc security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) tigervnc-1.14.1-10.el9_6, tigervnc-icons-1.14.1-10.el9_6, tigervnc-license-1.14.1-10.el9_6 +4
  • RHSA-2026:21741 Released 2026-05-28 · Red Hat rating Important
    tigervnc security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) tigervnc-1.11.0-22.el9_0.17, tigervnc-icons-1.11.0-22.el9_0.17, tigervnc-license-1.11.0-22.el9_0.17 +4
  • RHSA-2026:20576 Released 2026-05-26 · Red Hat rating Important
    tigervnc security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) tigervnc-1.12.0-14.el9_2.14, tigervnc-icons-1.12.0-14.el9_2.14, tigervnc-license-1.12.0-14.el9_2.14 +4
  • RHSA-2026:20575 Released 2026-05-26 · Red Hat rating Important
    tigervnc security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) tigervnc-1.13.1-8.el9_4.9, tigervnc-icons-1.13.1-8.el9_4.9, tigervnc-license-1.13.1-8.el9_4.9 +4
  • RHSA-2026:19342 Released 2026-05-19 · Red Hat rating Important
    tigervnc security update
    • Red Hat Enterprise Linux AppStream (v. 9) tigervnc-1.15.0-7.el9_8.1, tigervnc-icons-1.15.0-7.el9_8.1, tigervnc-license-1.15.0-7.el9_8.1 +4
  • RHSA-2026:13414 Released 2026-05-04 · Red Hat rating Important
    tigervnc security update
    • Red Hat Enterprise Linux AppStream (v. 8) tigervnc-1.15.0-9.el8_10, tigervnc-icons-1.15.0-9.el8_10, tigervnc-license-1.15.0-9.el8_10 +4
  • RHSA-2026:10739 Released 2026-04-27 · Red Hat rating Important
    tigervnc security update
    • Red Hat Enterprise Linux AppStream (v. 9) tigervnc-1.15.0-6.el9_7.1, tigervnc-icons-1.15.0-6.el9_7.1, tigervnc-license-1.15.0-6.el9_7.1 +4

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:13414
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:10739, RHSA-2026:19342
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:23254
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:24341
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:23255
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:21741
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:20576
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:20575
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:22424
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:23254
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:24341
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:23255
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2026:22456
Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION)Fixed RHSA-2026:23496
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2026:22456
Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION)Fixed RHSA-2026:23496

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34352
  2. 2026-10-03 Alias added: GHSA-4vj5-vh2w-8g5j

References

Patch 2

Advisory 1

Other 2

  • TI-2017-03586 Buffer overflow in the ModifiablePixelBuffer::fillRect function in TigerVNC before 1.7.1… CVSS 3.0CRITICAL 9.8
  • TI-2014-06801 XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer… CVSS 3.0CRITICAL 9.8
  • TI-2014-00011 Out-of-bounds write in TigerVNC CVSS 3.1CRITICAL 9.8
  • TI-2023-05938 Xorg-x11-server: out-of-bounds memory read in rrchangeoutputproperty and rrchangeproviderproperty CVSS 3.1HIGH 7.6
  • TI-2017-05047 In TigerVNC 1.7.1 (VNCSConnectionST.cxx VNCSConnectionST::fence), an authenticated client… CVSS 3.0HIGH 8.8
  • TI-2020-15960 In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers… CVSS 3.1HIGH 8.1
See all 29 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences