CVE-2026-109833 Memory corruption in Red Hat Enterprise Linux 10
A heap buffer overflow in GNOME Remote Desktop's VNC TLS handling allows remote attackers to cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-109833?
CVE-2026-109833 is a medium-severity memory corruption vulnerability in Red Hat Enterprise Linux 10, published on 13 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS read path, partial consumption of the internal peek buffer incorrectly moves remaining peeked bytes into the caller-supplied buffer instead of compacting the peek buffer. A remote attacker who can reach an enabled VNC TLS listener and trigger a peek/read size mismatch can cause an out-of-bounds write, leading to denial of service.
Weakness: CWE-121
Which versions are affected by CVE-2026-109833?
How do I fix CVE-2026-109833?
No fix has been published for CVE-2026-109833 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-109833 being exploited?
There is no known exploitation of CVE-2026-109833 in the wild and no public exploit code.
Sources
Also known as GHSA-ww8j-g775-7xjg, UBUNTU-CVE-2026-109833.