High severity8.8NVD Advisory· Published Sep 1, 2026· Updated Oct 1, 2026
CVE-2026-84268
CVE-2026-84268
Description
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
14- osv-coords13 versionspkg:rpm/almalinux/gvfspkg:rpm/almalinux/gvfs-afcpkg:rpm/almalinux/gvfs-afppkg:rpm/almalinux/gvfs-archivepkg:rpm/almalinux/gvfs-clientpkg:rpm/almalinux/gvfs-develpkg:rpm/almalinux/gvfs-fusepkg:rpm/almalinux/gvfs-goapkg:rpm/almalinux/gvfs-gphoto2pkg:rpm/almalinux/gvfs-mtppkg:rpm/almalinux/gvfs-smbpkg:rpm/opensuse/gvfs&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/gvfs&distro=openSUSE%20Tumbleweed
< 1.36.2-22.el8_10+ 12 more
- (no CPE)range: < 1.36.2-22.el8_10
- (no CPE)range: < 1.36.2-22.el8_10
- (no CPE)range: < 1.36.2-22.el8_10
- (no CPE)range: < 1.36.2-22.el8_10
- (no CPE)range: < 1.36.2-22.el8_10
- (no CPE)range: < 1.36.2-22.el8_10
- (no CPE)range: < 1.36.2-22.el8_10
- (no CPE)range: < 1.36.2-22.el8_10
- (no CPE)range: < 1.36.2-22.el8_10
- (no CPE)range: < 1.36.2-22.el8_10
- (no CPE)range: < 1.36.2-22.el8_10
- (no CPE)range: < 1.59.90-160000.3.1
- (no CPE)range: < 1.60.3-1.1
Patches
Vulnerability mechanics
References
6News mentions
1- GNOME gvfs: Four Vulnerabilities in MTP, AFP, SFTP Backends Disclosed TogetherVypr Intelligence · Sep 1, 2026