GNOME Remote Desktop CVE-2026-96541

Exploitation requires that the host is running gnome-remote-desktop with its RDP server (the RDP backend/remote-desktop sharing feature) enabled and its listening port reachable by the attacker; against such a configuration no authentication, credentials, or user interaction are needed (PR:N/UI:N), since the connection slots are consumed pre-authentication. The primary limiting factor is that gnome-remote-desktop RDP access is an opt-in feature not enabled by default on most systems, and network exposure is often restricted to LAN or VPN, narrowing the realistic attack surface. Impact is confined to blocking new RDP connections until a holding socket closes - it does not crash the host or affect other services.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a cleanly network-reachable, low-complexity, unauthenticated availability-only flaw, which is internally consistent with the description: an unauthenticated remote attacker opens RDP TCP connections and never completes the handshake, permanently holding connection-throttling slots because no pre-authentication handshake deadline is enforced. All signals agree that this is purely a denial-of-service issue - confidentiality and integrity impact are correctly rated N, so there is no data exposure or code execution risk. There is no EPSS score, no CISA KEV listing, and no public POC in the provided intelligence, so exploitation status is 'no public exploit identified at time of analysis'; however, the trivial mechanics (repeatedly open a socket and stall) mean weaponization is low-effort and easily scripted, which somewhat offsets the absence of published exploit code. Realistic priority is moderate rather than urgent: exploitation is only possible when gnome-remote-desktop's RDP server is actually enabled and network-reachable, and the impact is bounded to blocking new RDP sessions (existing sessions and the rest of the host are unaffected) until a holding socket is closed. No key CVSS/description conflicts exist - the network vector and unauthenticated rating are supported by the described pre-authentication attack.

An attacker who can reach the RDP listening port of a host running gnome-remote-desktop repeatedly opens TCP/RDP connections and deliberately never finishes the handshake, each connection permanently consuming one of the finite global connection-throttling slots. Once the global connection limit is saturated, legitimate users can no longer establish new RDP sessions until one of the attacker's holding sockets is closed. No public POC is referenced, but the technique is trivial to script and requires no authentication or user interaction.