CVE-2026-84268 Gvfs: sftp: heap-based buffer overflow in read_reply()
A malicious SFTP server can trigger a heap buffer overflow in gvfs, leading to denial of service or arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-84268?
CVE-2026-84268 is a high-severity memory corruption vulnerability in GNOME Red Hat Enterprise Linux 10, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution.
Weakness: CWE-122
Which versions are affected by CVE-2026-84268?
Linux distribution packages (40)
gvfs AlmaLinux:8 | All versions | 1.36.2-22.el8_10 |
gvfs-afc AlmaLinux:8 | All versions | 1.36.2-22.el8_10 |
gvfs-afp AlmaLinux:8 | All versions | 1.36.2-22.el8_10 |
gvfs-archive AlmaLinux:8 | All versions | 1.36.2-22.el8_10 |
gvfs-client AlmaLinux:8 | All versions | 1.36.2-22.el8_10 |
gvfs-devel AlmaLinux:8 | All versions | 1.36.2-22.el8_10 |
gvfs-fuse AlmaLinux:8 | All versions | 1.36.2-22.el8_10 |
gvfs-goa AlmaLinux:8 | All versions | 1.36.2-22.el8_10 |
gvfs-gphoto2 AlmaLinux:8 | All versions | 1.36.2-22.el8_10 |
gvfs-mtp AlmaLinux:8 | All versions | 1.36.2-22.el8_10 |
gvfs-smb AlmaLinux:8 | All versions | 1.36.2-22.el8_10 |
gvfs Red Hat:enterprise_linux:8::appstream | All versions | 0:1.36.2-22.el8_10 |
gvfs-afc Red Hat:enterprise_linux:8::appstream | All versions | 0:1.36.2-22.el8_10 |
gvfs-afc-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.36.2-22.el8_10 |
gvfs-afp Red Hat:enterprise_linux:8::appstream | All versions | 0:1.36.2-22.el8_10 |
gvfs-afp-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.36.2-22.el8_10 |
gvfs-archive Red Hat:enterprise_linux:8::appstream | All versions | 0:1.36.2-22.el8_10 |
gvfs-archive-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.36.2-22.el8_10 |
gvfs-client Red Hat:enterprise_linux:8::appstream | All versions | 0:1.36.2-22.el8_10 |
gvfs-client-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.36.2-22.el8_10 |
gvfs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.36.2-22.el8_10 |
gvfs-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:1.36.2-22.el8_10 |
gvfs-devel Red Hat:enterprise_linux:8::appstream | All versions | 0:1.36.2-22.el8_10 |
gvfs-fuse Red Hat:enterprise_linux:8::appstream | All versions | 0:1.36.2-22.el8_10 |
gvfs-fuse-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.36.2-22.el8_10 |
gvfs-goa Red Hat:enterprise_linux:8::appstream | All versions | 0:1.36.2-22.el8_10 |
gvfs-goa-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.36.2-22.el8_10 |
gvfs-gphoto2 Red Hat:enterprise_linux:8::appstream | All versions | 0:1.36.2-22.el8_10 |
gvfs-gphoto2-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.36.2-22.el8_10 |
gvfs-mtp Red Hat:enterprise_linux:8::appstream | All versions | 0:1.36.2-22.el8_10 |
gvfs-mtp-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.36.2-22.el8_10 |
gvfs-smb Red Hat:enterprise_linux:8::appstream | All versions | 0:1.36.2-22.el8_10 |
gvfs-smb-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.36.2-22.el8_10 |
gvfs Red Hat:enterprise_linux:8::crb | All versions | 0:1.36.2-22.el8_10 |
gvfs-afc-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:1.36.2-22.el8_10 |
gvfs-afp-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:1.36.2-22.el8_10 |
gvfs-archive-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:1.36.2-22.el8_10 |
gvfs-client-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:1.36.2-22.el8_10 |
gvfs-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:1.36.2-22.el8_10 |
gvfs-debugsource Red Hat:enterprise_linux:8::crb | All versions | 0:1.36.2-22.el8_10 |
How do I fix CVE-2026-84268?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-84268 being exploited?
There is no known exploitation of CVE-2026-84268 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:73997, CLSA-2026-1791805472, CLSA-2026-1792186767, CLSA-2026-1792194238, DEBIAN-CVE-2026-84268, GHSA-8cxg-v7p7-qc7j and 3 more.