GNOME Software: Four CVEs disclosed together, including privilege escalation and file write flaws
Four GNOME Foundation software vulnerabilities disclosed between Sept 7-10, 2026, include privilege escalation and arbitrary file write risks.
Key findings
- High severity CVE-2026-88924 in gvfs allows local privilege escalation via TOCTOU race condition.
- CVE-2026-74859 in gnome-tweaks permits arbitrary file writes through crafted theme archives using path traversal.
- CVE-2026-18090 in gdk-pixbuf enables heap out-of-bounds read via malicious .icns files.
- CVE-2026-86469 in GLib2 allows local file overwrites due to insecure temporary file handling.
On September 10, 2026, a batch of four vulnerabilities affecting GNOME Foundation software was disclosed, with the earliest disclosure on September 7th. The vulnerabilities span multiple components, including gvfs, gdk-pixbuf, gnome-tweaks, and GLib2, with severities ranging from Medium to High. These flaws present risks such as local privilege escalation, arbitrary file writes, and out-of-bounds reads, potentially impacting users who interact with specially crafted files or directories.
One of the more critical vulnerabilities, CVE-2026-88924, affects the admin backend of gvfs. A flaw in the privileged gvfsd-admin daemon allows it to change ownership of newly created private D-Bus sockets by using a link-following chown() function on a pathname within a user-controlled directory. This Time-of-Check Time-of-Use (TOCTOU) race condition can be exploited by a local attacker to gain elevated privileges.
Another vulnerability, CVE-2026-74859, resides in the shell theme installer of gnome-tweaks. This flaw allows a crafted theme archive to write files outside of the intended ~/.themes directory through path traversal, absolute paths, or symlink entries, as the installer does not validate archive member paths. This could lead to arbitrary file overwrites on the system.
In gdk-pixbuf, CVE-2026-18090 presents a risk to users opening specially crafted Apple Icon Image (.icns) files. A heap out-of-bounds read vulnerability exists in the uncompress() function, which handles RLE-encoded ICNS data. The function fails to validate source buffer boundaries during decompression, potentially leading to crashes or information disclosure.
Finally, CVE-2026-86469 in GLib2 involves a flaw in the g_file_replace() function when used with the G_FILE_CREATE_REPLACE_DESTINATION flag. If the creation of the temporary .goutputstream-XXXXXX file fails, the library unlinks the destination and recreates it without proper exclusive creation or symlink protection. A local attacker could exploit this to overwrite files in the destination directory.
The disclosed vulnerabilities highlight the importance of secure handling of user-supplied data and race conditions within system components. Users of GNOME software are advised to ensure their systems are updated to the latest versions once patches become available to mitigate these risks. Further investigation into specific version affected and patch details is recommended.