Resource exhaustion in GNOME Gnome-Remote-Desktop
CVE-2026-18358
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication connections to the RDP listener. This can accumulate accepted sockets and pending routing-token operations until timeout, exhausting resources and preventing legitimate users from establishing RDP sessions. This issue does not affect the upstream version.
Vulnerability class: DoS (Denial of Service)
EPSS: 0.005 (42.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Gnome Gnome-remote-desktop
- Red Hat Enterprise Linux 10 — versions 0:49.3-4.el10_2
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_REDHAT, vdb-entry)
- secalert@redhat.com (x_refsource_REDHAT, issue-tracking)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
Frequently asked questions
- What is CVE-2026-18358?
- CVE-2026-18358 is a high-severity vulnerability in GNOME Gnome-Remote-Desktop, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2026-07-31.
- How severe is CVE-2026-18358?
- High severity. CVSS v3 base score is 7.5 out of 10.