CVE-2026-109832: Gnome-remote-desktop: busy-wait dos in vnc tls i/o handlers (gnutls_e_again / gnutls_e_interrupted)
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLSEAGAIN and GNUTLSEINTERRUPTED) are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled VNC TLS listener can cause the event-loop thread to spin at high CPU with no forward progress, resulting in denial of service.
Other sources
AIONLYREPORT package: gnome-remote-desktop-49.3-1.el10 ------ Summary: Busy-Wait DoS in VNC TLS I/O Handlers (GNUTLSEAGAIN / GNUTLSEINTERRUPTED): retryable TLS read or write results can trap the VNC event-loop thread in an infinite busy loop, causing sustained CPU exhaustion and loss of VNC service availability. Requirements to exploit: An attacker needs network reachability to a running VNC listener provided by gnome-remote-desktop. The issue is configuration-dependent because VNC must be enabled and the connection must exercise the TLS VNC path; the shipped VNC schema uses tls-anon as the default allowed encryption method. Component affected: gnome-remote-desktop, VNC TLS handlers in src/grd-vnc-tls.c (doread() and grdvnctlswritetosocket()), reached from the VNC socket dispatch path in src/grd-session-vnc.c. Version affected: RHEL/CentOS gnome-remote-desktop package versions = 0.1.6-1 through <= 40.0-11 when the VNC service is enabled and the TLS handler path is used (downstream-only). ... Acknowledgement: Aisle Research
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running gnome-remote-desktop are exposed only when its VNC listener is enabled and connections use the TLS VNC path. An attacker must be able to reach that listener over the network.
Does an attacker need credentials or local access?
No. The reported vector is network-accessible with no required privileges or user interaction, provided the attacker can connect to the enabled VNC TLS listener.
Is an installation affected solely because gnome-remote-desktop is installed?
No. Exploitation is configuration-dependent: VNC must be enabled and the TLS VNC connection path must be exercised. The shipped VNC schema allows tls-anon as the default encryption method.