CVE-2026-34352 Missing authorization in TigerVNC

High 8.5 Published 26 Mar 2026 Updated 4 Jun 2026

Local users can observe or manipulate screen contents and crash the application due to incorrect file permissions in TigerVNC.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-34352?

CVE-2026-34352 is a high-severity missing authorization vulnerability in TigerVNC, published on 26 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an application crash, because of incorrect permissions.

Weakness: CWE-732

Which versions are affected by CVE-2026-34352?

It affects 1 product.

Linux distribution packages (19)

`tigervnc` SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS	All versions	`1.10.1-150400.7.15.1`
`tigervnc` SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS	All versions	`1.10.1-150400.7.15.1`
`tigervnc` SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS	All versions	`1.12.0-150500.4.3.1`
`tigervnc` SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS	All versions	`1.12.0-150500.4.3.1`
`tigervnc` SUSE:Linux Enterprise Module for Basesystem 15 SP7	All versions	`1.14.1-150700.4.3.1`
`tigervnc` SUSE:Linux Enterprise Module for Desktop Applications 15 SP7	All versions	`1.14.1-150700.4.3.1`
`tigervnc` SUSE:Linux Enterprise Server 12 SP5-LTSS	All versions	`1.6.0-22.23.1`
`tigervnc` SUSE:Linux Enterprise Server 15 SP4-LTSS	All versions	`1.10.1-150400.7.15.1`
`tigervnc` SUSE:Linux Enterprise Server 15 SP5-LTSS	All versions	`1.12.0-150500.4.3.1`
`tigervnc` SUSE:Linux Enterprise Server 15 SP6-LTSS	All versions	`1.13.1-150600.4.3.1`
`tigervnc` SUSE:Linux Enterprise Server 16.0	All versions	`1.15.0-160000.3.1`
`tigervnc` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5	All versions	`1.6.0-22.23.1`
`tigervnc` SUSE:Linux Enterprise Server for SAP Applications 15 SP4	All versions	`1.10.1-150400.7.15.1`
`tigervnc` SUSE:Linux Enterprise Server for SAP Applications 15 SP5	All versions	`1.12.0-150500.4.3.1`
`tigervnc` SUSE:Linux Enterprise Server for SAP Applications 15 SP6	All versions	`1.13.1-150600.4.3.1`
`tigervnc` SUSE:Linux Enterprise Server for SAP applications 16.0	All versions	`1.15.0-160000.3.1`
`tigervnc` openSUSE:Leap 15.6	All versions	`1.13.1-150600.4.3.1`
`tigervnc` openSUSE:Leap 16.0	All versions	`1.15.0-160000.3.1`
`tigervnc` openSUSE:Tumbleweed	All versions	`1.16.1-2.1`

Products include Tigervnc Tigervnc.

How do I fix CVE-2026-34352?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-34352 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34352 exists.

Sources

Also known as CLSA-2026-1776880484, CLSA-2026-1776941944, CLSA-2026-1777056907, DEBIAN-CVE-2026-34352, GHSA-4vj5-vh2w-8g5j, MGASA-2026-0088 and 10 more.