CVE catalog
CVE-2026-18358
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection thr
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.66% · Oct 25, 2026
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication connections to the RDP listener. This can accumulate accepted sockets and pending routing-token operations until timeout, exhausting resources and preventing legitimate users from establishing RDP sessions. This issue does not affect the upstream version.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | gnome-remote-desktop | sid | 51.0-1 | vulnerable |
| Debian | gnome-remote-desktop | forky | 51.0-1 | vulnerable |
| Debian | gnome-remote-desktop | trixie | 48.1-4 | not affected |
| Debian | gnome-remote-desktop | bookworm | 43.3-1 | not affected |
| Opensuse | gnome-remote-desktop | leap 16.0 | 48.3-160000.3.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | gnome-remote-desktop | source | sid | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | gnome-remote-desktop | source | forky | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | gnome-remote-desktop | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | gnome-remote-desktop | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Opensuse | gnome-remote-desktop | rpm | leap 16.0 | 48.3-160000.3.1 | Not reported | OPENSUSE-SU-2026:21888-1 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [gnome-remote-desktop]Not affected
Details (2)
43.3-1· amd64 · bookwormNot affected
nvd · gnome-remote-desktop · debian · bookworm
43.3-1· arm64 · bookwormNot affected
nvd · gnome-remote-desktop · debian · bookworm
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_54512.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-18358]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-18358]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:21888-1]
- [https://security-tracker.debian.org/tracker/CVE-2026-18358]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18358.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2829.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]