#1146478 gvfs: CVE-2026-84267 CVE-2026-84268 CVE-2026-84269 CVE-2026-84270

#1146478#5
Date:
2026-09-02 09:27:40 UTC
From:
To:
Hi,

The following vulnerabilities were published for gvfs.

CVE-2026-84267[0]:
| A flaw was found in the SFTP backend in gvfs. When mounting a share,
| a malicious SFTP server can cause read_string() to allocate a buffer
| with a certain length but the function does not verify that the
| buffer is completely filled, leaving the remainder of the buffer
| containing uninitialized heap contents. If the server sends a short
| FXP_HANDLE reply, these uninitialized bytes are taken as the file
| handle. The client will then echo these uninitialized bytes back to
| the server on all subsequent requests using that handle. With a
| length of 128 bytes, this issue allows the malicious server to
| deterministically read uninitialized heap memory from the gvfsd-sftp
| process, leaking its heap base and the load address of the libgio
| library, resulting in a deterministic defeat of Address Space Layout
| Randomization (ASLR).


CVE-2026-84268[1]:
| A flaw was found in the SFTP backend in gvfs. When mounting a share
| and reading a file, a malicious SFTP server can cause read_reply()
| to process a length that exceeds the size requested by the client.
| The function does not verify the server-provided length against the
| allocated buffer size, causing the operation to write past the
| intended boundaries. This issue allows a malicious server to corrupt
| adjacent heap memory in the gvfsd-sftp process, resulting in a
| denial of service as the process aborts upon detecting the heap
| corruption or potentially allowing arbitrary code execution.


CVE-2026-84269[2]:
| A flaw was found in the AFP backend in gvfs. When mounting a share,
| a malicious AFP server can cause the DSI read path to process a
| length that exceeds the size requested by the client. The function
| does not verify the server-provided length against the pre-sized
| reply buffer, causing the operation to access past the intended
| boundaries. This issue allows a malicious server to overflow a heap
| buffer and crash the gvfsd-afp process, resulting in a denial of
| service.


CVE-2026-84270[3]:
| A flaw was found in the MTP backend in gvfs. When reading a file
| from a mounted MTP device, do_read() in gvfsbackendmtp.c trusts the
| data length returned by the device without limiting it to the
| original size requested by the client. If a malicious MTP device
| responds with more bytes than requested, this unrestricted length is
| passed directly to memcpy(). This causes the operation to read
| memory outside the intended boundaries. This allows an attacker who
| plugs in a malicious MTP device to cause a segmentation fault when a
| file is read and crash the gvfsd-mtp process, resulting in a denial
| of service.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-84267
https://www.cve.org/CVERecord?id=CVE-2026-84267
[1] https://security-tracker.debian.org/tracker/CVE-2026-84268
https://www.cve.org/CVERecord?id=CVE-2026-84268
[2] https://security-tracker.debian.org/tracker/CVE-2026-84269
https://www.cve.org/CVERecord?id=CVE-2026-84269
[3] https://security-tracker.debian.org/tracker/CVE-2026-84270
https://www.cve.org/CVERecord?id=CVE-2026-84270

Regards,
Salvatore