Most recent entries from all

CVE-2026-84268 — Gvfs: sftp: heap-based buffer overflow in read_reply()

Affected: GNOME gvfs, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7

A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution.

USN-8845-1 — gvfs vulnerabilities

Affected: Ubuntu:Pro:16.04:LTS: gvfs, Ubuntu:Pro:18.04:LTS: gvfs, Ubuntu:Pro:20.04:LTS: gvfs, Ubuntu:22.04:LTS: gvfs, Ubuntu:24.04:LTS: gvfs, Ubuntu:26.04:LTS: gvfs

Keith Linneman discovered that GVfs did not properly validate data received from SFTP servers. An attacker could possibly use this issue to cause a heap buffer overflow, resulting in arbitrary code execution or a denial of service. (CVE-2026-84268)

It was discovered that GVfs incorrectly handled file ownership when creating private D-Bus sockets in the admin backend. A local attacker could possibly use this issue to change the ownership of arbitrary system files, resulting in privilege escalation to root. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-88924)