EUVD-2026-98475
GHSA-426g-qgmm-69jx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach enabled VNC TLS listener
-
DeliveryInitiate TLS I/O returning retryable status
-
ExploitTrigger unbounded busy loop in handler
-
ExecutionEvent-loop thread spins at high CPU
-
ImpactDenial of service of remote desktop
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Loop termination conditions
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires gnome-remote-desktop to be running with the VNC backend and a TLS-enabled VNC listener active and reachable over the network; the flaw lives specifically in the VNC TLS I/O handlers' treatment of retryable GnuTLS results (GNUTLS_E_AGAIN, GNUTLS_E_INTERRUPTED). Against that configuration no authentication or user interaction is needed (PR:N/UI:N) and default configurations are affected only insofar as VNC TLS is turned on. The primary limiting factor is that gnome-remote-desktop's VNC TLS listener is not enabled by default on typical RHEL installs and is usually confined to desktop systems rather than servers, so hosts without an exposed VNC TLS listener are not exploitable; network reachability to that listener is the gating prerequisite. |
| Impact | This is a genuine but bounded availability-only issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) and CWE-835 (uncontrolled loop/infinite loop) are internally consistent with the description: a remote, unauthenticated attacker reaching an enabled VNC TLS listener forces the event-loop thread into an unbounded busy loop at high CPU with no forward progress - a classic resource-exhaustion DoS with zero confidentiality or integrity impact. No EPSS score, KEV listing, POC, SSVC decision, or patch version was provided in the input, so exploitation probability and real-world activity cannot be quantified; there is no public exploit identified at time of analysis. The key tempering factor the raw 7.5 hides is reachability: exploitation requires the gnome-remote-desktop VNC backend with a TLS listener to be enabled and network-reachable, which is not the default posture on most RHEL systems. Net: treat as a real but conditional priority - high severity where VNC TLS is deliberately exposed, low practical risk on the majority of deployments where that listener is disabled or firewalled. |
| Exploit ScenarioDerived | An attacker with network reach to a RHEL host running gnome-remote-desktop with the VNC TLS listener enabled repeatedly drives the TLS handshake/I/O into a state returning GNUTLS_E_AGAIN or GNUTLS_E_INTERRUPTED. Because these retryable results are handled by an unbounded busy loop rather than yielding to the event loop, the event-loop thread spins at 100% CPU with no progress, denying remote-desktop service. No credentials or user interaction are required (PR:N/UI:N), and no POC is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Denial of service in GNOME Remote Desktop (gnome-remote-desktop) as shipped in Red Hat Enterprise Linux 8, 9, and 10 allows an unauthenticated remote attacker to pin the daemon's event-loop thread at high CPU by sending traffic to a TLS-enabled VNC listener, causing the service to stop making forward progress. The defect is in the VNC TLS I/O handlers, which treat retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) with an unbounded busy loop instead of returning control to the event loop, so the thread spins indefinitely rather than waiting for socket readiness. No public exploit code exists and there is no confirmed active exploitation, and practical exposure is bounded: the VNC backend must be running with a TLS listener reachable over the network, a configuration that is not enabled by default on typical RHEL installs and is far more common on desktops than on servers.
RemediationAI
No vendor-released patch has been identified from the available data at the time of analysis; the Red Hat CVE page (https://access.redhat.com/security/cve/CVE-2026-109832) and Bugzilla issue (https://bugzilla.redhat.com/show_bug.cgi?id=2550352) are the authoritative sources for errata and fixed package builds and should be monitored for updates before applying anything. Until a fix is published, the most effective control is to eliminate exposure: disable the VNC backend or its TLS listener on hosts that do not need it (through the GNOME Remote Desktop configuration tooling, for example grdctl or the corresponding gsettings schema), accepting the trade-off that remote VNC access to the desktop is lost. Where VNC is genuinely required, restrict the listener to trusted networks or localhost with firewall rules or bind-address changes and tunnel access over SSH, keeping in mind that this limits legitimate clients and does little against an attacker already on the permitted segment. Additional compensating measures include running gnome-remote-desktop under a supervisor that restarts it on CPU-driven hangs (accepting repeated short outages), applying cgroup or systemd CPU quotas so a spinning thread cannot starve the rest of the host, and alerting on sustained high CPU in the gnome-remote-desktop process as a detection signal, though none of these address the root cause and all should be replaced by the vendor fix as soon as one is available.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GNOME Remote Desktop is the RDP/VNC server component shipped in RHEL, and its VNC backend uses GnuTLS for transport security. On non-blocking sockets, GnuTLS returns the retryable status codes GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED to signal that the caller should try again later; correct non-blocking design is to yield back to the GLib main loop (the event loop) and resume I/O when the underlying file descriptor becomes readable or writable again. In the affected VNC TLS I/O handlers, those retryable results are instead fed into an unbounded loop that immediately retries, producing a tight busy-wait with no blocking or yield point. This is the classic software defect class described by CWE-835 (Loop with Unreachable Exit Condition, i.e., an infinite loop): under attacker-controlled timing the loop never terminates or exits to the event loop, and the event-loop thread consumes CPU without servicing other clients. Because the trigger is a retryable TLS state rather than a memory-safety condition, the impact is confined to availability - there is no confidentiality or integrity component (C:N/I:N, A:H) and no privilege boundary crossed beyond the network-facing daemon. The assigned CPEs (red_hat:red_hat_enterprise_linux_8, _9, and _10) indicate the flaw is treated as affecting all three supported RHEL major streams where gnome-remote-desktop ships, with the reported origin being Red Hat's own tracking.
Know when Red Hat Enterprise Linux 10 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated reach to the VNC TLS listener (AV:N/PR:N/UI:N) reliably triggers the loop (AC:L); impact is availability-only CPU exhaustion, so C:N/I:N/A:H.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled VNC TLS listener can cause the event-loop thread to spin at high CPU with no forward progress, resulting in denial of service.
Executive ViewAI
Red Hat Enterprise Linux 8, 9, and 10 systems running GNOME Remote Desktop with a network-reachable TLS-enabled VNC listener are susceptible to a high-severity denial-of-service vulnerability that can cause the service to become unresponsive due to excessive CPU usage. Although this configuration is not enabled by default and is more prevalent on desktops than servers, affected systems may experience service disruption requiring administrative intervention. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis; leadership should focus on identifying exposed instances and implementing interim mitigations.
Disable the VNC TLS listener if not required; restrict network access to the VNC port using firewall rules or network segmentation; monitor for high CPU usage in gnome-remote-desktop and restart the service as needed; consider using an alternative remote desktop solution until a patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Exploit-DB