CVE-2026-18358 is a denial of service vulnerability in gnome-remote-desktop on Red Hat Enterprise Linux 10. When the daemon runs in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated attacker to open many parallel pre-authentication connections to the RDP listener. This leads to accumulation of accepted sockets and pending routing-token operations until timeout, exhausting system resources and preventing legitimate users from establishing RDP sessions. The vulnerability does not affect upstream versions and requires explicit configuration to enable system-mode RDP with network accessibility. Red Hat has released a security update to fix this issue.

An unauthenticated remote attacker can cause a denial of service by exhausting resources on the system running gnome-remote-desktop in system mode with RDP enabled. This prevents legitimate users from establishing RDP sessions. The impact is limited to availability and does not affect confidentiality or integrity. The attack surface is limited because exploitation requires a non-default configuration where system-mode RDP is enabled and accessible from untrusted networks.

Red Hat has released a security update that fixes this vulnerability. Users should apply the update as described in the Red Hat advisory. If system-mode RDP is not required, it should be disabled. If it must remain enabled, restrict access to the RDP listener (default port 3389) to trusted hosts or management networks using host-based firewall rules. These mitigations reduce the risk of exploitation by limiting exposure.