CVE-2026-109833: Stack-based Buffer Overflow in Red Hat Red Hat Enterprise Linux 10

The vulnerability in gnome-remote-desktop on Red Hat Enterprise Linux 10 involves improper handling of the internal peek buffer during VNC TLS reads. Specifically, when a peek/read size mismatch occurs, the remaining peeked bytes are moved incorrectly into the caller's buffer instead of compacting the peek buffer, resulting in a stack-based buffer overflow. This flaw can be exploited remotely by an attacker able to reach an enabled VNC TLS listener to cause an out-of-bounds write that leads to denial of service.

A remote attacker with network access to an enabled VNC TLS listener can exploit this vulnerability to cause an out-of-bounds write, resulting in denial of service. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-109833 for current remediation guidance. Until a patch is applied, consider disabling the VNC TLS listener if it is not required to reduce exposure.