CVE-2026-18358 in Red Hat
Summary
by MITRE • 07/31/2026
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication connections to the RDP listener. This can accumulate accepted sockets and pending routing-token operations until timeout, exhausting resources and preventing legitimate users from establishing RDP sessions. This issue does not affect the upstream version.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/31/2026
This vulnerability exists within the gnome-remote-desktop implementation distributed by Red Hat Enterprise Linux and represents a significant denial-of-service risk that undermines the security posture of remote desktop services. The flaw manifests specifically when the daemon operates in system mode with RDP (Remote Desktop Protocol) functionality enabled, creating an exploitable condition that allows unauthenticated attackers to overwhelm the service's connection handling mechanisms. The vulnerability stems from improper implementation of connection throttling controls within the incoming connection handler component, which fails to enforce rate limiting or resource management policies during the pre-authentication phase of RDP connections.
The technical nature of this flaw can be categorized as a resource exhaustion vulnerability that operates through connection flooding attacks, where malicious actors exploit the bypassed throttler mechanism to establish numerous parallel pre-authentication connections simultaneously. This condition creates a cascading effect wherein accepted sockets accumulate in memory while pending routing-token operations queue for processing, ultimately leading to system resource depletion. The attack vector requires only network access to the RDP listener port and does not require any authentication credentials, making it particularly dangerous as it can be executed by anyone on the network. This behavior directly violates security principles related to resource management and access control, as outlined in CWE-400 which addresses excessive resource consumption vulnerabilities.
The operational impact of this vulnerability extends beyond simple service disruption to create a persistent threat that can severely degrade system availability and compromise legitimate user access. When exploited successfully, the vulnerability prevents authorized users from establishing legitimate RDP sessions by exhausting available connection slots and processing resources, effectively creating a denial-of-service condition that can persist until the affected service is manually restarted or the system is rebooted. The timing of resource exhaustion occurs gradually as connections accumulate, making detection difficult and allowing attackers to maintain their impact without immediate system alerts. This vulnerability affects enterprise environments where remote desktop services are critical for administrative access and system management operations.
Mitigation strategies should focus on implementing immediate network-level controls including firewall rules that restrict RDP access to trusted IP addresses and implement connection rate limiting at the network perimeter. System administrators should also consider disabling RDP functionality when not actively required, particularly in environments where the vulnerability cannot be immediately patched or upgraded. The most effective long-term solution involves upgrading to patched versions of gnome-remote-desktop that properly implement connection throttling mechanisms and maintain proper resource accounting during pre-authentication phases. Additionally, monitoring systems should be configured to detect unusual connection patterns and rapid connection establishment rates that could indicate exploitation attempts. This vulnerability aligns with ATT&CK technique T1499 which covers network denial-of-service attacks, specifically targeting service availability through resource exhaustion methods. Organizations should also implement proper network segmentation to limit exposure of RDP services to only necessary administrative networks, reducing the attack surface and minimizing potential impact from such vulnerabilities.