CVE-2025-4478

Name	CVE-2025-4478
Description	A flaw was found in the gnome-remote-desktop used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault. This issue causes the service to crash and remain defunct, resulting in a denial of service. It occurs pre-boot and is likely due to a NULL pointer dereference. Rebooting is required to recover the system.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1105917

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
gnome-remote-desktop (PTS)	bullseye	0.1.9-5	vulnerable
	bookworm	43.3-1	vulnerable
	trixie	48.1-1	vulnerable
	sid	48.1-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
gnome-remote-desktop	source	(unstable)	(unfixed)			1105917

Notes

[bookworm] - gnome-remote-desktop <no-dsa> (Minor issue)
https://bugzilla.redhat.com/show_bug.cgi?id=2365232
Related: https://gitlab.gnome.org/GNOME/gnome-remote-desktop/-/issues/196