LiveActive security incident?Get immediate response
CVE Record

CVE-2025-5024: Gnome-remote-desktop: uncontrolled resource consumption due to malformed rdp pdus

A flaw was found in gnome-remote-desktop. Once gnome-remote-desktop listens for RDP connections, an unauthenticated attacker can exhaust system resources and repeatedly crash the process. There may be a resource leak after many attacks, which will also result in gnome-remote-desktop no longer being able to open files even after it is restarted via systemd.

HighCVSS 7.4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2025-5024 can let an unauthenticated remote party crash GNOME Remote Desktop when RDP is enabled. The main business impact is loss of remote desktop availability, with possible lingering file-handle exhaustion after repeated attacks. It does not indicate data theft or code execution in the provided sources.

Executive priority

Treat as a high-priority availability risk for exposed Linux desktop and remote-access environments. Patch or disable reachable RDP services promptly, especially where remote desktop availability supports operations, administration, or customer-facing support.

Technical view

Malformed RDP protocol data units can trigger uncontrolled resource consumption in gnome-remote-desktop. The vulnerability is network reachable when the service listens for RDP connections, requires no attacker privileges, and affects availability only. Red Hat rates it High with CVSS 7.4 and CWE-400.

Likely exposure

Exposure is likely limited to affected Red Hat Enterprise Linux 8, 9, and 10 systems with gnome-remote-desktop installed and RDP enabled or reachable. Desktop, VDI, admin workstation, and jump-host use cases should be prioritized over systems without GNOME Remote Desktop listening.

Exploitation context

The bundle does not show CISA KEV listing or cited evidence of active exploitation. The described attack path is unauthenticated and network-based once RDP listening is enabled, but the provided sources do not include exploit availability, proof-of-concept details, or observed attacks.

Researcher notes

The key constraint is exposure state: the package alone is not enough; RDP listening matters. The CVSS vector includes UI:R, but the description frames attackability after the service is enabled. Sources do not provide exploit artifacts or full root-cause detail beyond malformed RDP PDUs and resource leakage.

Mitigation direction

  • Apply the relevant Red Hat RHSA update for the installed RHEL stream and package.
  • Disable gnome-remote-desktop or RDP where remote desktop access is not required.
  • Restrict RDP access to trusted VPN, management networks, or approved source addresses.
  • Follow Red Hat guidance for restart or reboot requirements after package updates.
  • Monitor affected hosts for repeated service crashes or file exhaustion symptoms.

Validation and detection

  • Inventory RHEL 8, 9, and 10 systems with the gnome-remote-desktop package installed.
  • Confirm whether GNOME Remote Desktop is configured to listen for RDP connections.
  • Map installed package versions to the affected versions listed in the CVE bundle.
  • Verify applicable RHSA updates are installed for each affected RHEL lifecycle stream.
  • Review service logs for repeated crashes around remote desktop connection attempts.
Prepared
Confidence
high
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-400: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2025-5024 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.4 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
5Timeline events
1ADP providers
14Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.4CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H2.84redhat

Vulnerability scoring details

Base CVSS 3.1 score

7.4High
CVSS 3.1 vector shape for CVE-2025-5024Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. Source timelineredhat

    Reported to Red Hat.

  2. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  3. Source timelineredhat

    Made public.

  4. CVE publishedCVE Program

    The CVE record was published.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Red HatRed Hat Enterprise Linux 10gnome-remote-desktop, 0:47.3-2.el10_0affected
Red HatRed Hat Enterprise Linux 8gnome-remote-desktop, 0:0.1.8-4.el8_10affected
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Supportgnome-remote-desktop, 0:0.1.6-9.el8_2.1affected
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportgnome-remote-desktop, 0:0.1.8-4.el8_4affected
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Ongnome-remote-desktop, 0:0.1.8-4.el8_4affected
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportgnome-remote-desktop, 0:0.1.8-4.el8_6affected
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Servicegnome-remote-desktop, 0:0.1.8-4.el8_6affected
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutionsgnome-remote-desktop, 0:0.1.8-4.el8_6affected
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Servicegnome-remote-desktop, 0:0.1.8-4.el8_8affected
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutionsgnome-remote-desktop, 0:0.1.8-4.el8_8affected
Red HatRed Hat Enterprise Linux 9gnome-remote-desktop, 0:40.0-11.el9_6affected
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutionsgnome-remote-desktop, 0:40.0-10.el9_0affected
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutionsgnome-remote-desktop, 0:40.0-10.el9_2affected
Red HatRed Hat Enterprise Linux 9.4 Extended Update Supportgnome-remote-desktop, 0:40.0-11.el9_4affected
Weakness

CWE details

CWE-400

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-400 · source CWE mapping

Uncontrolled Resource Consumption

Uncontrolled Resource Consumption represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs