CVE-2026-18358: high-severity vulnerability in gnome-remote-desktop
Gnome-remote-desktop: gnome-remote-desktop system-mode rdp server missing connection throttling allows unauthenticated denial of service
Published · Updated
Follow this CVE+ Monitor Red Hat Enterprise Linux+ Monitor Red Hat Enterprise Linux 10.0 Extended Update Support
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.7%
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication connections to the RDP listener. This can accumulate accepted sockets and pending routing-token operations until timeout, exhausting resources and preventing legitimate users from establishing RDP sessions. This issue does not affect the upstream version.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
GNOME · gnome-remote-desktopRed Hat · Red Hat Enterprise Linux 10Red Hat · Red Hat Enterprise Linux 10.0 Extended Update SupportRed Hat · Red Hat Enterprise Linux 8Red Hat · Red Hat Enterprise Linux 9Related CVEs — gnome-remote-desktop
In the same product, most dangerous first.
CVE-2024-6387HIGHOpenssh: regresshion - race condition in ssh allows rce/dosEPSS 99.5%CVE-2024-3094CRITICALXz: malicious code in distributed sourceEPSS 90.9%CVE-2024-12084CRITICALRsync: heap buffer overflow in rsync due to improper checksum length handlingEPSS 72.5%CVE-2025-10230CRITICALSamba: command injection in wins server hook scriptEPSS 39.8%CVE-2025-26466MEDIUMOpenssh: denial-of-service in opensshEPSS 38.7%CVE-2024-6409HIGHOpenssh: possible remote code execution due to a race condition in signal handling affecting red hat enterprise linux 9EPSS 27.9%