Log in Start free

Vulnerability · Published Sep 23, 2026 · Assigned by redhat

CVE-2026-96541Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake deadline

High 7.5

In plain English

A high-severity uncontrolled resource consumption in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.9%top 39.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global connection limit, an attacker can prevent new RDP clients from connecting until a holding socket is closed.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:14gnome-remote-desktopno fix listedDEBIAN-CVE-2026-96541
Ubuntu:22.04:LTSgnome-remote-desktopno fix listedUBUNTU-CVE-2026-96541
Ubuntu:24.04:LTSgnome-remote-desktopno fix listedUBUNTU-CVE-2026-96541
Ubuntu:26.04:LTSgnome-remote-desktopno fix listedUBUNTU-CVE-2026-96541
Ubuntu:26.10gnome-remote-desktopno fix listedUBUNTU-CVE-2026-96541

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References