Quick answers
- Is CVE-2026-18358 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-18358 being exploited in the wild.
- How severe is CVE-2026-18358?
- High severity, with a CVSS score of 7.5, published 31 July 2026.
- Which products and versions are affected?
- Red Hat Red Hat Enterprise Linux 10 gnome-remote-desktop-49.3-1.el10.
- Is there a fix for CVE-2026-18358?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-18358 attacked?
- It is attacked over the network, in an operating system.
- Am I affected by CVE-2026-18358?
- Check whether you run Red Hat GNOME Remote Desktop. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A flaw exists in the RDP ingress handling of gnome-remote-desktop when running in system mode (--system). The 'on_incoming_as_system_headless' handler in 'src/grd-rdp-server.c' bypasses the 'grd_throttler_handle_connection' mechanism used in other modes, instead passing connections directly to 'grd_routing_token_peek_async'. An unauthenticated remote attacker can exploit this by opening numerous parallel TCP connections to the RDP listener (typically port 3389). This accumulates accepted sockets and asynchronous routing-token operations, exhausting available resources and denying legitimate RDP access until the two-second peek timeout expires. The issue is specific to the Red Hat distribution and does not affect upstream GNOME.
Affected products
- Red Hat Red Hat Enterprise Linux 10 gnome-remote-desktop-49.3-1.el10
Timeline
- 2026-04-26: disclosed: Initial private notification to Red Hat
- 2026-07-31: advisory: CVE published by Red Hat and NVD