CVE-2026-34352: TigerVNC Information Disclosure Flaw

CVE-2026-34352 Overview

CVE-2026-34352 is an insecure permissions vulnerability in TigerVNC's x0vncserver component affecting versions prior to 1.16.2. The vulnerability exists in the Image.cxx file where shared memory segments are created with overly permissive file permissions (0777), allowing any local user on the system to observe or manipulate screen contents being shared through the VNC server. This flaw can lead to unauthorized information disclosure, screen manipulation, or application crashes.

Critical Impact

Local attackers can read or modify VNC screen contents and potentially crash the x0vncserver application due to insecure shared memory permissions.

Affected Products

• TigerVNC versions prior to 1.16.2
• x0vncserver component (unix/x0vncserver/Image.cxx)
• Systems using shared memory (SHM) for screen sharing

Discovery Timeline

• 2026-03-26 - CVE-2026-34352 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-34352

Vulnerability Analysis

This vulnerability falls under CWE-732 (Incorrect Permission Assignment for Critical Resource). The x0vncserver component in TigerVNC uses POSIX shared memory (shmget) to efficiently share screen buffer data. The vulnerable code creates shared memory segments with permissions set to 0777, which grants read, write, and execute permissions to all users on the system—not just the user running the VNC server.

In multi-user environments, this presents a significant security risk. Any local user can attach to these shared memory segments using standard system calls, enabling them to view sensitive information displayed on the VNC session or even inject malicious content into the screen buffer. The scope extends beyond the vulnerable component's security context, as the compromised shared memory can affect data confidentiality and integrity system-wide.

Root Cause

The root cause lies in the shmget() system call within unix/x0vncserver/Image.cxx, where the permission mask IPC_CREAT|0777 is used when allocating shared memory. This grants world-readable and world-writable permissions to the shared memory segment containing screen image data. The fix changes this to IPC_CREAT|0600, restricting access to only the owner (the user running x0vncserver).

Attack Vector

The attack requires local access to the target system. An attacker with a local unprivileged account can enumerate shared memory segments using standard tools like ipcs, identify segments owned by x0vncserver processes, and attach to them using shmat(). Once attached, the attacker can:

1. Read screen contents to capture sensitive information (passwords, confidential documents, etc.)
2. Write to the shared memory to inject malicious visual content
3. Corrupt the memory segment causing application instability or crashes

 
   shminfo->shmid = shmget(IPC_PRIVATE,
                           xim->bytes_per_line * xim->height,
-                          IPC_CREAT|0777);
+                          IPC_CREAT|0600);
   if (shminfo->shmid == -1) {
     perror("shmget");
     vlog.error("shmget() failed (%d bytes requested)",

Source: GitHub TigerVNC Commit

Detection Methods for CVE-2026-34352

Indicators of Compromise

• Unexpected shared memory segment accesses by unauthorized users visible in audit logs
• Multiple processes attached to x0vncserver shared memory segments (check with ipcs -m)
• Unusual x0vncserver crashes or instability that may indicate memory tampering
• Unauthorized users running tools that enumerate or attach to shared memory

Detection Strategies

• Monitor for shmat() and shmget() system calls targeting memory segments owned by VNC server processes
• Implement audit rules to track access to shared memory segments: auditctl -a always,exit -F arch=b64 -S shmat -S shmget
• Review active shared memory segments and their permissions using ipcs -m -p to identify overly permissive allocations
• Deploy endpoint detection rules to flag processes attaching to shared memory they don't own

Monitoring Recommendations

• Enable system call auditing for shared memory operations on systems running x0vncserver
• Implement file integrity monitoring on TigerVNC binary files to detect unauthorized modifications
• Monitor x0vncserver process stability and log any unexpected terminations
• Establish baseline of legitimate shared memory usage patterns to identify anomalous access

How to Mitigate CVE-2026-34352

Immediate Actions Required

• Upgrade TigerVNC to version 1.16.2 or later immediately
• Restrict local system access to only trusted users on systems running x0vncserver
• Audit current shared memory segments for improper permissions using ipcs -m
• Consider temporarily disabling x0vncserver on multi-user systems until patched

Patch Information

TigerVNC version 1.16.2 addresses this vulnerability by changing the shared memory permission mask from 0777 to 0600 in the Image.cxx file. This ensures only the owner of the x0vncserver process can access the shared memory segment.

Patch details are available at:

• GitHub TigerVNC Commit
• SourceForge TigerVNC Release
• TigerVNC Announcement

Workarounds

• Limit local login access to systems running x0vncserver to only essential administrative users
• Run x0vncserver in isolated environments such as containers or virtual machines where other users cannot access shared memory
• Use operating system-level mandatory access controls (SELinux/AppArmor) to restrict shared memory access
• Monitor and audit shared memory segment access until the patch can be applied

# Configuration example
# Check for vulnerable shared memory permissions
ipcs -m | grep -v "^--" | awk '{print $1, $3}' | while read id perms; do
  if [ "$perms" = "777" ]; then
    echo "WARNING: Shared memory segment $id has world-accessible permissions"
  fi
done

# Apply restrictive permissions to limit local access (temporary workaround)
# Ensure only essential users can log into systems running x0vncserver