CVE-2026-34352: tigervnc
CVSS: 9.8v3.1CriticalModified
AliasesMGASA-2026-0088SUSE-SU-2026:1252-1SUSE-SU-2026:1301-1SUSE-SU-2026:1302-1SUSE-SU-2026:1303-1SUSE-SU-2026:1360-1SUSE-SU-2026:21140-1UBUNTU-CVE-2026-34352DEBIAN-CVE-2026-34352openSUSE-SU-2026:10470-1openSUSE-SU-2026:20465-1
Published 26-03-2026Last modified 04-06-2026
Vulnerability summary
CVE-2026-34352 is a critical (CVSS 9.8) vulnerability in tigervnc. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 34.8% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
0.42%
0%100%
Low · +0.17 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 12Timeline
- 26-03-2026PublishedVulnerability first disclosed.
- 04-06-2026Last modifiedVulnerability information updated.
Description
In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an application crash, because of incorrect permissions.
CVSS metrics
4 scores · 4 sources · 1 versionCritical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSources4 sources · 8.5–9.8
- CVE.orgCNA8.5HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.42%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
+0.17 pp
From 0.25% on 19-09-2026
19-09-202619-10-2026
EPSS score0.42%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Suse16 products
- tigervnc&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 1.10.1-150400.7.15.1
- tigervnc&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 1.10.1-150400.7.15.1
- tigervnc&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 1.12.0-150500.4.3.1
- tigervnc&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS< 1.12.0-150500.4.3.1
- tigervnc&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7< 1.14.1-150700.4.3.1
Opensuse3 products
- tigervnc&distro=openSUSE Leap 15.6< 1.13.1-150600.4.3.1
- tigervnc&distro=openSUSE Leap 16.0< 1.15.0-160000.3.1
- tigervnc&distro=openSUSE Tumbleweed< 1.16.1-2.1
Debian1 product
- tigervncAll versions (No fix recorded) | < 1.15.0+dfsg-2.1~deb13u1
Mageia1 product
- tigervnc< 1.13.1-2.10.mga9
Tigervnc1 product
- tigervnc< 1.16.2
Ubuntu1 product
- tigervncAll versions (No fix recorded)
6 vendors · 23 products
