Log in Start free

Vulnerability · Published Jul 31, 2026 · Assigned by redhat

CVE-2026-18358Gnome-remote-desktop: gnome-remote-desktop system-mode rdp server missing connection throttling allows unauthenticated denial of service

High 7.5

In plain English

A high-severity uncontrolled resource consumption in gnome-remote-desktop from GNOME. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 48.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication connections to the RDP listener. This can accumulate accepted sockets and pending routing-token operations until timeout, exhausting resources and preventing legitimate users from establishing RDP sessions. This issue does not affect the upstream version.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10gnome-remote-desktop49.3-4.el10_2ALSA-2026:54512
Debian:14gnome-remote-desktopno fix listedDEBIAN-CVE-2026-18358
Rocky Linux:10gnome-remote-desktop0:49.3-4.el10_2RLSA-2026:54512
Ubuntu:22.04:LTSgnome-remote-desktopno fix listedUBUNTU-CVE-2026-18358
Ubuntu:24.04:LTSgnome-remote-desktopno fix listedUBUNTU-CVE-2026-18358
Ubuntu:26.04:LTSgnome-remote-desktopno fix listedUBUNTU-CVE-2026-18358
Ubuntu:26.10gnome-remote-desktopno fix listedUBUNTU-CVE-2026-18358

Affected products (as reported)

VendorProductVersions
GNOME gnome-remote-desktop see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References