CVE-2025-5024

HighCVSS 7.4

Published: 22/05/2025(UTC)Updated: 30/06/2026(UTC)Translated: 01/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.78%

51th percentile - higher than 51% of all known CVEs

Summary

A flaw in gnome-remote-desktop allows an unauthenticated attacker to exhaust system resources and repeatedly crash the process. After many attacks, a resource leak may prevent gnome-remote-desktop from opening files even after a systemd restart.

Risk Assessment

An attacker can cause denial of service of the remote desktop service (RDP) and persistent application state corruption, requiring manual administrator intervention.

Recommendation

Immediately update gnome-remote-desktop to the latest patched version. Until then, restrict RDP port (default 3389) access to trusted networks only.

Other vulnerabilities in gnome-remote-desktop

CVE-2026-18358High
In gnome-remote-desktop as shipped in Red Hat Enterprise Linux, when the daemon runs in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler. This allows an unauthenticated remote attacker to open many parallel pre-authentication connections, exhausting resources and preventing legitimate users from establishing RDP sessions.

Original NVD description (English source)

A flaw was found in gnome-remote-desktop. Once gnome-remote-desktop listens for RDP connections, an unauthenticated attacker can exhaust system resources and repeatedly crash the process. There may be a resource leak after many attacks, which will also result in gnome-remote-desktop no longer being able to open files even after it is restarted via systemd.