CVE-2026-84270
published 2026-09-01CVE-2026-84270: A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, do_read() in gvfsbackendmtp.c trusts the data length returned by…
PriorityP415medium4.3CVSS 3.1
AVPACLPRNUIRSUCNINAH
EPSS
0.22%
11.6th percentile
A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, do_read() in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested, this unrestricted length is passed directly to memcpy(). This causes the operation to read memory outside the intended boundaries. This allows an attacker who plugs in a malicious MTP device to cause a segmentation fault when a file is read and crash the gvfsd-mtp process, resulting in a denial of service.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnome | gvfs | < 1.60.2 | 1.60.2 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
gvfs: MTP: out-of-bounds read in do_read()
vendor_redhat·2026-08-03·CVSS 4.3
CVE-2026-84270 [MEDIUM] CWE-125 gvfs: MTP: out-of-bounds read in do_read()
gvfs: MTP: out-of-bounds read in do_read()
A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, do_read() in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested, this unrestricted length is passed directly to memcpy(). This causes the operation to read memory outside the intended boundaries. This allows an attacker who plugs in a malicious MTP device to cause a segmentation fault when a file is read and crash the gvfsd-mtp process, resulting in a denial of service.
Statement: To exploit this issue, an attacker needs to plug in a malicious MTP device, limiting its exposure. Furthermore, the direct security imp
GHSA
A flaw was found in the MTP backend in gvfs.
ghsa_unreviewed·2026-09-01
CVE-2026-84270 [MEDIUM] CWE-125 A flaw was found in the MTP backend in gvfs.
A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, do_read() in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested, this unrestricted length is passed directly to memcpy(). This causes the operation to read memory outside the intended boundaries. This allows an attacker who plugs in a malicious MTP device to cause a segmentation fault when a file is read and crash the gvfsd-mtp process, resulting in a denial of service.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-84270 gvfs: MTP: out-of-bounds read in do_read() [fedora-all]
bugzilla·2026-09-01·CVSS 4.3
CVE-2026-84270 [MEDIUM] CVE-2026-84270 gvfs: MTP: out-of-bounds read in do_read() [fedora-all]
CVE-2026-84270 gvfs: MTP: out-of-bounds read in do_read() [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, do_read() in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested, this unrestricted length is passed directly to memcpy(). This causes the operation to read memory outside the intended boundaries. This allows an attacker who plugs in a malicious MTP device to cause a
Bugzilla
CVE-2026-84270 gvfs: MTP: out-of-bounds read in do_read()
bugzilla·2026-09-01·CVSS 4.3
CVE-2026-84270 [MEDIUM] CVE-2026-84270 gvfs: MTP: out-of-bounds read in do_read()
CVE-2026-84270 gvfs: MTP: out-of-bounds read in do_read()
A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, do_read() in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested, this unrestricted length is passed directly to memcpy(). This causes the operation to read memory outside the intended boundaries. This allows an attacker who plugs in a malicious MTP device to cause a segmentation fault when a file is read and crash the gvfsd-mtp process, resulting in a denial of service. This vulnerability affects all gvfs versions and is fixed in version 1.60.2.
2026-09-01
Published