CVE-2026-18358 is a resource exhaustion vulnerability in gnome-remote-desktop on Red Hat Enterprise Linux. When running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing unauthenticated attackers to open numerous parallel pre-authentication connections. This leads to accumulation of accepted sockets and pending routing-token operations until timeout, exhausting system resources and denying service to legitimate users. The vulnerability is specific to the Red Hat Enterprise Linux packaging and does not affect the upstream gnome-remote-desktop version.

An unauthenticated remote attacker can cause a denial of service by exhausting resources on the RDP listener, preventing legitimate users from establishing remote desktop sessions. There is no impact on confidentiality or integrity, but availability is severely affected.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18358 for current remediation guidance. Since this vulnerability is specific to Red Hat Enterprise Linux's gnome-remote-desktop packaging, follow vendor instructions for updates or workarounds. No vendor advisory content explicitly states that no action is required or that the issue is already mitigated.