CVE-2026-109833: Gnome-remote-desktop: heap buffer overflow in gnome-remote-desktop vnc tls peek buffer handling allows remote denial of service
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS read path, partial consumption of the internal peek buffer incorrectly moves remaining peeked bytes into the caller-supplied buffer instead of compacting the peek buffer. A remote attacker who can reach an enabled VNC TLS listener and trigger a peek/read size mismatch can cause an out-of-bounds write, leading to denial of service.
Other sources
AIONLYREPORT package: gnome-remote-desktop ------ Summary: Heap buffer overflow in TLS peek buffer handling: In grdvnctlsreadfromsocket(), leftover bytes from the internal TLS peek buffer are incorrectly memmove()d into the caller-supplied read buffer buf when len < peekbufferlen, causing an out-of-bounds write and leaving the peek-buffer state inconsistent. Requirements to exploit: Network reachability to a GNOME Remote Desktop VNC deployment that exercises the VNC TLS path; attacker must trigger a sequence where peek buffers more data than a following read consumes (peekbufferlen > 2 len for the overflow). Component affected: gnome-remote-desktop, src/grd-vnc-tls.c (grdvnctlsreadfromsocket(), grdvnctlspeekatsocket()) Version affected: RHEL/CentOS gnome-remote-desktop package versions = 0.1.6-1 through <= 40.0-11 (downstream only) Patch available: yes Upstream coordination: Downstream only CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - 6.5 Impact: Moderate Embargo: no Acknowledgement: Aisle Research Vulnerability Details: When toread < tlssession->peekbufferlen, the code copies toread bytes into buf, then memmove()s the remaining peeked bytes into buf again instead of compacting tlssession->peekbuffer and reducing peekbufferlen, producing an out-of-bounds write and inconsistent pending state. CWE: CWE-787
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Exposure requires a GNOME Remote Desktop VNC deployment with a reachable, enabled VNC TLS listener. The affected component is gnome-remote-desktop as shipped in Red Hat Enterprise Linux.
What does an attacker need to do to trigger the flaw?
An unauthenticated remote attacker needs network reachability to the VNC TLS service and must cause a peek/read size mismatch. The overflow condition requires the TLS peek buffer to contain more than twice the length of the subsequent read.
What is the expected impact of successful exploitation?
Successful exploitation can cause an out-of-bounds heap write and denial of service. The provided severity vector indicates no confidentiality or integrity impact.