A flaw in TigerVNC’s x0vncserver component, present before version 1.16.2, permits any other local user on the same system to view or alter the server’s screen content and, in some cases, trigger a crash. This results in unauthorized data exposure, potential tampering with displayed information, and disruption of service. The underlying weakness stems from improper authorization and incorrect file permissions (CWE‑279 and CWE‑732).

The vulnerability affects TigerVNC, specifically versions earlier than 1.16.2. Users running any of those earlier releases on a multi‑user machine are at risk. Upgrading to 1.16.2 or later eliminates the issue.

The CVSS score of 8.5 indicates a high severity, but the EPSS score of less than 1% suggests that exploitation is unlikely to be widespread. The vulnerability is local; an attacker must be a separate user account on the same host and exploit the permissive executable permissions of x0vncserver. No remote exploitation vector is reported, and the flaw is not listed in the CISA KeV catalog, reducing the immediacy of known attacks but still requiring mitigation due to its high impact if a local attacker gains access.