EUVD-2026-98479
GHSA-ww8j-g775-7xjg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach enabled VNC TLS listener over network
-
ExploitSend TLS data causing peek/read size mismatch
-
ImpactOut-of-bounds write corrupts stack, crashing gnome-remote-desktop
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires gnome-remote-desktop to be running with remote desktop sharing enabled using the VNC backend AND a TLS listener active and reachable from the attacker's network position - this is not a default-enabled configuration on headless or server RHEL installs. The attacker must additionally drive the connection into a peek/read size mismatch in the TLS read path, which the CVSS AC:H rating marks as non-trivial to achieve reliably. Limiting factors: no authentication is modeled (PR:N) but the listener must be deliberately enabled and exposed; impact is limited to availability (service crash), with no confidentiality or integrity consequence per the vector. |
| Impact | This is a moderate-severity, availability-only issue (CVSS 5.9, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) and should be treated as a routine patch rather than an emergency. The network vector (AV:N) and lack of required privileges or user interaction (PR:N/UI:N) are the only aggravating signals; they are offset by high attack complexity (AC:H - the attacker must reliably provoke a peek/read size mismatch in the TLS read path) and the fact that impact is confined to denial of service (C:N/I:N, A:H), with no code execution or data exposure claimed. No EPSS score, CISA KEV entry, SSVC decision, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization; per the data this is 'no public exploit identified at time of analysis.' Note that CWE-121 (stack-based buffer overflow) plus an out-of-bounds write could in principle imply more than DoS, but the Red Hat description and the CVSS impact metrics both constrain the realistic outcome to a crash - treat any code-execution speculation as unconfirmed absent a vendor statement. Net: real but low-urgency for most sites, materially elevated only where a VNC TLS listener is actually exposed to untrusted networks. |
| Exploit ScenarioDerived | An attacker with network reach to a host running gnome-remote-desktop with an enabled VNC TLS listener sends TLS traffic engineered to cause partial consumption of the internal peek buffer, producing a peek/read size mismatch. Remaining peeked bytes are copied into the caller-supplied buffer rather than compacting the peek buffer, triggering a stack out-of-bounds write that crashes the service (denial of service). No public exploit code is identified in the provided data, and the high attack complexity means reliable triggering is non-trivial. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
A stack-based out-of-bounds write in GNOME Remote Desktop's VNC TLS read path, as shipped in Red Hat Enterprise Linux 8, 9, and 10, can crash the service and cause denial of service. An unauthenticated remote attacker (per the CVSS vector PR:N) who can reach an enabled VNC TLS listener and drive the connection into a peek/read size mismatch can corrupt memory on the stack; the vector rates this CVSS 5.9 with availability-only impact (C:N/I:N/A:H) and high attack complexity (AC:H), reflecting that the mismatch is non-trivial to trigger reliably. The vulnerable configuration is not default: remote desktop sharing must be explicitly enabled with the VNC backend and a reachable TLS listener, which is uncommon on headless or server RHEL installs; no public exploit code and no confirmed active exploitation were identified at time of analysis, and this should be handled as a routine patch rather than an emergency.
RemediationAI
No vendor-released patch was identified at time of analysis; the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-109833 and Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2550367 should be monitored for an updated gnome-remote-desktop package and its exact fixed build, and that package should be applied via the normal RHEL update channel once it appears. Until then, the highest-fidelity mitigation is to disable the vulnerable exposure entirely: turn off remote desktop sharing, or switch the connection from the VNC backend to the RDP backend if screen sharing is operationally required - the trade-off is that VNC clients used by existing users will no longer connect. Where VNC must remain enabled, bind the TLS listener only to a trusted interface or loopback and require access through an SSH tunnel or VPN, and restrict reachability with host firewall rules; the trade-off is reduced remote-access convenience and additional client configuration. Avoid exposing the VNC TLS listener to untrusted networks, and consider running the service under a supervisor that restarts it automatically so that a successful crash results in a brief interruption rather than a prolonged outage - noting that a restart does not prevent the flaw from being triggered again. Monitor the advisory for a fixed gnome-remote-desktop build and treat this as a routine patch, consistent with its moderate severity and availability-only impact.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in the TLS read path used by GNOME Remote Desktop's VNC backend (gnome-remote-desktop), specifically in the logic that consumes an internal "peek" buffer. When only part of the peeked data is consumed, the correct behavior is to compact the peek buffer so the unconsumed bytes remain in place; instead, the implementation incorrectly moves the remaining peeked bytes into the caller-supplied buffer, leaving the buffer accounting inconsistent. A subsequent peek/read size mismatch then writes beyond the intended destination, which classifies as CWE-121 (stack-based buffer overflow) per Red Hat and aligns with the "Buffer Overflow" and "Stack Overflow" tags in the intelligence feed. The affected packages are the gnome-remote-desktop builds shipped in Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, and Red Hat Enterprise Linux 9 (CPEs cpe:2.3:a:red_hat:red_hat_enterprise_linux_10, ..._8, and ..._9). The exposure window is the VNC-over-TLS listener; because the defect is a buffer-handling logic error rather than a cryptographic weakness, TLS encryption does not mitigate it. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates the bug is remotely triggerable without credentials but is difficult to exploit deterministically, and that the observable consequence is service termination rather than code execution or data exposure as assessed.
Know when Vnc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable VNC TLS listener gives AV:N/PR:N/UI:N; reliably forcing a peek/read size mismatch justifies AC:H; impact is a crash only, so C:N/I:N/A:H.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS read path, partial consumption of the internal peek buffer incorrectly moves remaining peeked bytes into the caller-supplied buffer instead of compacting the peek buffer. A remote attacker who can reach an enabled VNC TLS listener and trigger a peek/read size mismatch can cause an out-of-bounds write, leading to denial of service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB