CVE-2026-109833
5.9MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-121
Impact
Remote attackers can crash gnome-remote-desktop by causing an out-of-bounds write. They need network access to reach an enabled VNC TLS listener and trigger a specific read size mismatch.
Root cause
The VNC TLS read path incorrectly moves remaining peeked bytes into the caller's buffer instead of compacting its internal peek buffer during partial reads.
Affected systems
gnome-remote-desktop on Red Hat Enterprise Linux; specific affected version ranges are not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade gnome-remote-desktop once updated packages are available for your RHEL release. Until patched, disable the VNC service or block incoming connections to the VNC TLS port.
$ sudo dnf upgrade gnome-remote-desktopAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS read path, partial consumption of the internal peek buffer incorrectly moves remaining peeked bytes into the caller-supplied buffer instead of compacting the peek buffer. A remote attacker who can reach an enabled VNC TLS listener and trigger a peek/read size mismatch can cause an out-of-bounds write, leading to denial of service.