I don't see a CVE id listed, but the fix appears to be pretty simple:

shminfo->shmid = shmget(IPCPRIVATE, xim->bytesperline xim->height, - IPCCREAT|0777); + IPCCREAT|0600);

https://github.com/TigerVNC/tigervnc/commit/0b5cab169d847789efa54459a87659d3fd484393

-------- Forwarded Message -------- Subject: [tigervnc-announce] TigerVNC 1.16.1 Date: Wed, 25 Mar 2026 09:59:26 +0100 From: Pierre Ossman <ossman () cendio se> Organization: Cendio AB To: tigervnc-announce () googlegroups com

The bug fix release TigerVNC 1.16.1 is now available. This release is primarily a security release to fix an issue in x0vncserver, where other users can observe and manipulate the screen contents. Users of x0vncserver are advised to update immediately.

The release also contains a fix for using the Plain security type with the new w0vncserver, as well as some translation updates.

Binaries are available from SourceForge:

https://sourceforge.net/projects/tigervnc/files/stable/1.16.1

Regards The TigerVNC Developers

-------- Forwarded Message -------- Subject: [tigervnc-announce] TigerVNC 1.16.2 Date: Thu, 26 Mar 2026 21:49:34 +0100 From: Pierre Ossman <ossman () cendio se> Organization: Cendio AB To: tigervnc-announce () googlegroups com

This is a second attempt at a bug fix release for the security issue in x0vncserver. The TigerVNC 1.16.1 release unfortunately had all fixes except the security fix.

Apologies for the extra noise and confusion.

Binaries are available from SourceForge:

https://sourceforge.net/projects/tigervnc/files/stable/1.16.2

Regards The TigerVNC Developers

-- You received this message because you are subscribed to the Google Groups "TigerVNC Announcements" group. To unsubscribe from this group and stop receiving emails from it, send an email to tigervnc-announce+unsubscribe () googlegroups com. To view this discussion visit https://groups.google.com/d/msgid/tigervnc-announce/dcedc354-d653-4354-b281-cfd9f58139be%40cendio.se.