Red Hat gnome-remote-desktop: Denial of service in VNC TLS I/O handlers
Summary
A flaw in gnome-remote-desktop as shipped in Red Hat Enterprise Linux lets a remote attacker who can reach an enabled VNC TLS listener drive the event-loop thread into an unbounded busy loop. The thread spins at high CPU without making progress, which causes a denial of service of the remote desktop service. No credentials or user interaction are required, and confidentiality and integrity are not affected, so exposure of the VNC listener is the decisive factor.
Affected
- Red Hat Enterprise Linux 8, 9 and 10 (default: affected)
- Affected only when the VNC service is enabled and the TLS path is used
- Package range per Red Hat statement: >= 0.1.6-1 through <= 40.0-11
- The default shipped VNC encryption setting includes tls-anon
Fixed in
Unknown. No fixed package build or RHSA errata was found in the sources at the time of review.
Workaround
- If VNC is not required, disable the gnome-remote-desktop VNC service (grdctl vnc disable; check with grdctl status first)
- If VNC must stay enabled, restrict the VNC listener to trusted hosts or management networks with host-based firewall rules
Exploitation
- CISA SSVC: Exploitation none, automatable yes, technical impact partial
- Not marked as known exploited in the sources reviewed
- No public proof of concept found; this is not confirmation that none exists
Our recommendation
- Inventory hosts running gnome-remote-desktop and check whether the VNC service is enabled
- Disable VNC where it is not needed; where the port must remain, restrict access to it
- Watch the Red Hat CVE page and Bugzilla 2550352 for the fixed package and errata, then patch promptly
- Do not make VNC listeners reachable from the internet or untrusted networks
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE record CVE-2026-109832 access.redhat.com
- Red Hat Bugzilla 2550352 bugzilla.redhat.com
- Ubuntu CVE record CVE-2026-109832 ubuntu.com
- OSV UBUNTU-CVE-2026-109832 osv.dev
- SUSE CVE record via vulners vulners.com
- hol.org CVE summary hol.org
- grdctl manpage (Ubuntu) manpages.ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 19:51.
Original description (NVD)
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled VNC TLS listener can cause the event-loop thread to spin at high CPU with no forward progress, resulting in denial of service.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.