CVE-2026-84269
published 2026-09-01CVE-2026-84269: A flaw was found in the AFP backend in gvfs. When mounting a share, a malicious AFP server can cause the DSI read path to process a length that exceeds the…
PriorityP432medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.45%
37.8th percentile
A flaw was found in the AFP backend in gvfs. When mounting a share, a malicious AFP server can cause the DSI read path to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the pre-sized reply buffer, causing the operation to access past the intended boundaries. This issue allows a malicious server to overflow a heap buffer and crash the gvfsd-afp process, resulting in a denial of service.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnome | gvfs | < 1.60.2 | 1.60.2 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
gvfs: AFP: heap-based buffer overflow in DSI read path
vendor_redhat·2026-08-03·CVSS 6.5
CVE-2026-84269 [MEDIUM] CWE-122 gvfs: AFP: heap-based buffer overflow in DSI read path
gvfs: AFP: heap-based buffer overflow in DSI read path
A flaw was found in the AFP backend in gvfs. When mounting a share, a malicious AFP server can cause the DSI read path to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the pre-sized reply buffer, causing the operation to access past the intended boundaries. This issue allows a malicious server to overflow a heap buffer and crash the gvfsd-afp process, resulting in a denial of service.
Statement: To exploit this issue, an attacker needs a user to connect to a malicious AFP share (for example, by clicking a crafted afp:// link), limiting its exposure. Furthermore, the direct security impact of this flaw is a denial of service due to the heap-based buffer
GHSA
A flaw was found in the AFP backend in gvfs.
ghsa_unreviewed·2026-09-01
CVE-2026-84269 [MEDIUM] CWE-122 A flaw was found in the AFP backend in gvfs.
A flaw was found in the AFP backend in gvfs. When mounting a share, a malicious AFP server can cause the DSI read path to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the pre-sized reply buffer, causing the operation to access past the intended boundaries. This issue allows a malicious server to overflow a heap buffer and crash the gvfsd-afp process, resulting in a denial of service.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-84269 gvfs: AFP: heap-based buffer overflow in DSI read path
bugzilla·2026-09-01·CVSS 6.5
CVE-2026-84269 [MEDIUM] CVE-2026-84269 gvfs: AFP: heap-based buffer overflow in DSI read path
CVE-2026-84269 gvfs: AFP: heap-based buffer overflow in DSI read path
A flaw was found in the AFP backend in gvfs. When mounting a share, a malicious AFP server can cause the DSI read path to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the pre-sized reply buffer, causing the operation to access past the intended boundaries. This issue allows a malicious server to overflow a heap buffer and crash the gvfsd-afp process, resulting in a denial of service. This vulnerability affects all gvfs versions and is fixed in version 1.60.2.
Bugzilla
CVE-2026-84269 gvfs: AFP: heap-based buffer overflow in DSI read path [fedora-all]
bugzilla·2026-09-01·CVSS 6.5
CVE-2026-84269 [MEDIUM] CVE-2026-84269 gvfs: AFP: heap-based buffer overflow in DSI read path [fedora-all]
CVE-2026-84269 gvfs: AFP: heap-based buffer overflow in DSI read path [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in the AFP backend in gvfs. When mounting a share, a malicious AFP server can cause the DSI read path to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the pre-sized reply buffer, causing the operation to access past the intended boundaries. This issue allows a malicious server to overflow a heap buffer and crash the gvfsd-afp process, resulting in a denial of service. This vulnerability af
2026-09-01
Published