Hi, The following vulnerabilities were published for gvfs. CVE-2026-84267[0]: | A flaw was found in the SFTP backend in gvfs. When mounting a share, | a malicious SFTP server can cause read_string() to allocate a buffer | with a certain length but the function does not verify that the | buffer is completely filled, leaving the remainder of the buffer | containing uninitialized heap contents. If the server sends a short | FXP_HANDLE reply, these uninitialized bytes are taken as the file | handle. The client will then echo these uninitialized bytes back to | the server on all subsequent requests using that handle. With a | length of 128 bytes, this issue allows the malicious server to | deterministically read uninitialized heap memory from the gvfsd-sftp | process, leaking its heap base and the load address of the libgio | library, resulting in a deterministic defeat of Address Space Layout | Randomization (ASLR). CVE-2026-84268[1]: | A flaw was found in the SFTP backend in gvfs. When mounting a share | and reading a file, a malicious SFTP server can cause read_reply() | to process a length that exceeds the size requested by the client. | The function does not verify the server-provided length against the | allocated buffer size, causing the operation to write past the | intended boundaries. This issue allows a malicious server to corrupt | adjacent heap memory in the gvfsd-sftp process, resulting in a | denial of service as the process aborts upon detecting the heap | corruption or potentially allowing arbitrary code execution. CVE-2026-84269[2]: | A flaw was found in the AFP backend in gvfs. When mounting a share, | a malicious AFP server can cause the DSI read path to process a | length that exceeds the size requested by the client. The function | does not verify the server-provided length against the pre-sized | reply buffer, causing the operation to access past the intended | boundaries. This issue allows a malicious server to overflow a heap | buffer and crash the gvfsd-afp process, resulting in a denial of | service. CVE-2026-84270[3]: | A flaw was found in the MTP backend in gvfs. When reading a file | from a mounted MTP device, do_read() in gvfsbackendmtp.c trusts the | data length returned by the device without limiting it to the | original size requested by the client. If a malicious MTP device | responds with more bytes than requested, this unrestricted length is | passed directly to memcpy(). This causes the operation to read | memory outside the intended boundaries. This allows an attacker who | plugs in a malicious MTP device to cause a segmentation fault when a | file is read and crash the gvfsd-mtp process, resulting in a denial | of service. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-84267 https://www.cve.org/CVERecord?id=CVE-2026-84267 [1] https://security-tracker.debian.org/tracker/CVE-2026-84268 https://www.cve.org/CVERecord?id=CVE-2026-84268 [2] https://security-tracker.debian.org/tracker/CVE-2026-84269 https://www.cve.org/CVERecord?id=CVE-2026-84269 [3] https://security-tracker.debian.org/tracker/CVE-2026-84270 https://www.cve.org/CVERecord?id=CVE-2026-84270 Regards, Salvatore