Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:LCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-34352 is a high-severity Incorrect Permission Assignment for Critical Resource (CWE-732) vulnerability in Tigervnc Tigervnc. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Executable Installer File Permissions Weakness (T1574.005); ranked at the 16th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-34352 is a vulnerability in TigerVNC versions prior to 1.16.2, affecting the Image.cxx component within x0vncserver. It stems from incorrect permissions (CWE-732), enabling unauthorized access to screen contents. The issue carries a CVSS v3.1 base score of 8.5 (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L), indicating high severity due to its potential for confidentiality violations, limited integrity and availability impacts, and scoped effects.
Local attackers with unprivileged access can exploit this vulnerability without requiring user interaction or elevated privileges. Successful exploitation allows them to observe or manipulate the victim's screen contents or trigger an application crash, potentially enabling screen scraping, limited tampering, or denial-of-service against the x0vncserver process.
Mitigation is addressed in TigerVNC 1.16.2, available via SourceForge downloads. The fixing commit is at https://github.com/TigerVNC/tigervnc/commit/0b5cab169d847789efa54459a87659d3fd484393, with announcements on the TigerVNC Google Group (https://groups.google.com/g/tigervnc-announce/c/anHL9WLshLI) and OSS-Security mailing list (https://www.openwall.com/lists/oss-security/2026/03/26/7). Security practitioners should prioritize upgrading affected systems.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16468
Vulnerability Data
In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an application crash, because of incorrect permissions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 5 hardening rules · 3 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
Enforces the access control policy that defines permissions on resources, thereby stopping incorrect assignments from remaining exploitable.
Directly requires assignment of only the minimum necessary permissions, preventing overly broad grants on critical resources.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Topic-specific policies on asset management and secure configuration establish expectations for correct permission settings on critical resources, lowering the likelihood that default or overly permissive permissions will be left in place.
Classification results drive the assignment of permissions and handling procedures, decreasing the likelihood that critical resources receive incorrect or overly permissive permission settings.
By requiring owners to determine and document the exact permissions needed for each asset, the control reduces the likelihood that default or overly permissive file and resource permissions will be left in place.
Documented provisioning and revocation procedures reduce the chance that critical resources retain overly permissive default or leftover permissions after personnel changes.
Documented responsibility for protecting assets encourages correct permission settings rather than leaving them at insecure defaults.
Monitoring supplier policy changes and conducting audits can reveal incorrect permission assignments on resources managed by the supplier, prompting corrective action before they are exploited.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248577 OL 8 must enable kernel parameters to enforce Discretionary Access Control (DAC) on symlinks. prevents CWE-732
Windows Server 2016 (2 rules)
- V-224972 Active Directory Group Policy objects must have proper access control permissions. prevents CWE-732
- V-224831 Local volumes must use a format that supports NTFS attributes. prevents CWE-732
Windows Server 2019 (2 rules)
- V-205741 Windows Server 2019 Active Directory Group Policy objects must have proper access control permissions. prevents CWE-732
- V-205663 Windows Server 2019 local volumes must use a format that supports NTFS attributes. prevents CWE-732