CVE-2026-96541

Summary

A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global connection limit, an attacker can prevent new RDP clients from connecting until a holding socket is closed.

Affected Software

VendorProductVersion RangeStatus

Weaknesses

  • CWE-400: Uncontrolled Resource Consumption

Workarounds

Disable the RDP listener when it is not required, or restrict access to the RDP port to trusted networks or hosts at the network boundary. No application-level mitigation that preserves unrestricted RDP access is known.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: yes
    • Technical Impact: partial

Additional References

References