gnome-remote-desktop CVE-2026-18358

Exploitation requires that gnome-remote-desktop is running in system mode with the RDP backend enabled and its listener (typically TCP 3389) reachable by the attacker; this specific deployment mode is the exact prerequisite drawn from the description. When that configuration is present, no authentication, credentials, or user interaction are needed (AV:N/AC:L/PR:N/UI:N) - the abuse occurs entirely in the pre-authentication connection-handling path. The primary limiting factors are configuration and exposure: systems not using system-mode RDP, or where the RDP port is firewalled off from untrusted networks, are not exploitable, and the flaw is limited to Red Hat's downstream RHEL 8/9/10 builds and does not affect upstream gnome-remote-desktop.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a network-reachable, low-complexity, unauthenticated attack with no user interaction whose sole impact is high availability loss - no confidentiality or integrity impact, consistent with a pure DoS. No EPSS score, SSVC decision, or KEV status was supplied, so exploitation probability cannot be quantified from the input; the vulnerability is not listed in CISA KEV and no POC was referenced. The realistic priority is moderated by exposure: impact only materializes when gnome-remote-desktop is deployed in system mode with RDP enabled and the listener is network-reachable, which is a specific, non-default-for-most-servers configuration rather than a universally exposed service. Net assessment: a genuine, easy-to-trigger availability risk for the subset of RHEL systems using system-mode RDP, but low blast radius elsewhere; treat as high priority only where RDP remote login is actually exposed.

An attacker who can reach a RHEL host running gnome-remote-desktop in system mode with RDP enabled repeatedly opens many parallel TCP connections to the RDP port without authenticating. Each connection is accepted and triggers a pending routing-token operation, and because the throttler is bypassed these accumulate until timeout, exhausting sockets and resources so legitimate users can no longer establish RDP sessions. No public exploit is identified, but the low attack complexity (AC:L) and lack of authentication (PR:N) make the flood trivial to script.