CVE-2026-84268
published 2026-09-01CVE-2026-84268: A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that…
PriorityP352high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.36%
28.1th percentile
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnome | gvfs | < 1.60.2 | 1.60.2 |
| ubuntu | gvfs | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_redhat8.8HIGH
vendor_ubuntu8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
GVfs vulnerabilities
vendor_ubuntu·2026-09-30·CVSS 8.8
CVE-2026-84268 [HIGH] GVfs vulnerabilities
Title: GVfs vulnerabilities
Summary: Several security issues were fixed in GVfs.
Keith Linneman discovered that GVfs did not properly validate data
received from SFTP servers. An attacker could possibly use this issue to
cause a heap buffer overflow, resulting in arbitrary code execution or a
denial of service. (CVE-2026-84268)
It was discovered that GVfs incorrectly handled file ownership when
creating private D-Bus sockets in the admin backend. A local attacker
could possibly use this issue to change the ownership of arbitrary
system files, resulting in privilege escalation to root. This issue only
affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-88924)
Instructions: After a standard system update you need to restart your session to make
all the necessary
Red Hat
gvfs: SFTP: heap-based buffer overflow in read_reply()
vendor_redhat·2026-07-03·CVSS 8.8
CVE-2026-84268 [HIGH] CWE-122 gvfs: SFTP: heap-based buffer overflow in read_reply()
gvfs: SFTP: heap-based buffer overflow in read_reply()
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution.
Statement: To exploit this issue, an attacker needs a user to connect to a malicious SFTP share (for example, by clicking a crafted sftp:// link or inter
GHSA
A flaw was found in the SFTP backend in gvfs.
ghsa_unreviewed·2026-09-01
CVE-2026-84268 [HIGH] CWE-122 A flaw was found in the SFTP backend in gvfs.
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-84268 gvfs: SFTP: heap-based buffer overflow in read_reply() [fedora-all]
bugzilla·2026-09-01·CVSS 8.8
CVE-2026-84268 [HIGH] CVE-2026-84268 gvfs: SFTP: heap-based buffer overflow in read_reply() [fedora-all]
CVE-2026-84268 gvfs: SFTP: heap-based buffer overflow in read_reply() [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the p
Bugzilla
CVE-2026-84268 gvfs: SFTP: heap-based buffer overflow in read_reply()
bugzilla·2026-08-31·CVSS 8.8
CVE-2026-84268 [HIGH] CVE-2026-84268 gvfs: SFTP: heap-based buffer overflow in read_reply()
CVE-2026-84268 gvfs: SFTP: heap-based buffer overflow in read_reply()
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution. This vulnerability affects all gvfs versions and is fixed in version 1.60.2.
2026-09-01
Published