CVE-2026-84267: 
Linux Debian Analyse et atténuation des vulnérabilités

CVE-2026-84267 is a memory disclosure vulnerability in the SFTP backend of gvfs (GNOME Virtual File System), classified as "uninitialized heap disclosure in read_string()." A malicious SFTP server can exploit this flaw to leak uninitialized heap memory from the gvfsd-sftp process, enabling a deterministic bypass of Address Space Layout Randomization (ASLR). The vulnerability affects gvfs versions 1.10.0 and newer, and is fixed in version 1.60.2. It was disclosed on September 1, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat Advisory, GitHub Advisory).

The root cause is CWE-908 (Use of Uninitialized Resource): the read_string() function in gvfs's SFTP backend allocates a buffer of a specified length but does not verify that the buffer is completely filled before use. When a malicious SFTP server sends a short FXP_HANDLE reply, the remainder of the allocated buffer retains uninitialized heap contents, which are then treated as the file handle. On all subsequent SFTP requests using that handle, the client echoes these uninitialized bytes back to the server. With a handle length of 128 bytes, the attacker can deterministically extract the heap base address of the gvfsd-sftp process and the load address of the libgio library, defeating ASLR (Red Hat Advisory, Red Hat Bugzilla). Exploitation requires user interaction — the victim must connect to the attacker-controlled SFTP server (e.g., via a crafted sftp:// link or a man-in-the-middle scenario).

Successful exploitation results in an information disclosure limited to specific memory contents: the heap base address of the gvfsd-sftp process and the load address of the libgio library. This does not directly expose user data, but the ASLR bypass it enables can serve as a prerequisite for chaining with additional memory corruption vulnerabilities to achieve more severe outcomes such as arbitrary code execution. There is no direct impact on integrity or availability (Red Hat Advisory).

As of the disclosure date, there is no evidence of active in-the-wild exploitation or a public proof-of-concept exploit (Feedly). The NVD SSVC assessment notes exploitation status as "poc," suggesting a PoC may exist or be feasible, though none has been publicly confirmed. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for user interaction — a victim must actively connect to a malicious SFTP server (Red Hat Advisory).

1. Set up a malicious SFTP server: The attacker configures a server that implements the SSH File Transfer Protocol but is modified to send a deliberately short FXP_HANDLE reply (e.g., fewer bytes than the declared handle length, such as 4 bytes instead of 128).
2. Lure the victim: The attacker delivers a crafted sftp:// URI to the target user via phishing, a malicious web page, or a man-in-the-middle attack on an unverified SFTP connection, causing the victim's GNOME desktop environment to initiate a gvfs SFTP mount.
3. Trigger the vulnerability: When the victim's gvfsd-sftp process connects and receives the short FXP_HANDLE reply, read_string() allocates a 128-byte buffer but only partially fills it, leaving the remainder as uninitialized heap memory.
4. Harvest leaked memory: The client echoes the full 128-byte buffer (including uninitialized bytes) back to the attacker's server on subsequent SFTP requests. The attacker reads these bytes to extract the heap base address and libgio load address from the gvfsd-sftp process.
5. Use leaked addresses: The attacker uses the recovered addresses to defeat ASLR, enabling precise targeting for any subsequent memory corruption exploit against the same process (Red Hat Advisory, Red Hat Bugzilla).

• Network: Outbound SFTP connections (TCP port 22) from the gvfsd-sftp process to unexpected or unknown external IP addresses; SFTP sessions where the server sends unusually short FXP_HANDLE responses.
• Process: Unexpected spawning of gvfsd-sftp processes, particularly initiated by user interaction with a sftp:// URI from an untrusted source.
• Logs: System or GNOME session logs showing SFTP mount attempts to unfamiliar or external hosts; authentication logs (/var/log/auth.log) showing outbound SSH/SFTP connections to unknown servers.

Update gvfs to version 1.60.2 or later, which contains the fix for this vulnerability (Red Hat Bugzilla). As an immediate workaround, Red Hat advises users not to connect to untrusted SFTP servers (Red Hat Advisory). Additional mitigations include network segmentation to restrict SFTP connections to only trusted, verified servers, and user awareness training to avoid clicking unknown sftp:// links.

Red Hat credited Keith Linneman (LinnemanLabs) with discovering and reporting this vulnerability (Red Hat Advisory). Red Hat rated the vulnerability as "Moderate" severity, noting that exploitation requires user interaction and that the direct impact is limited to memory address disclosure rather than user data exposure. The issue was tracked in the GNOME GitLab issue tracker and Red Hat Bugzilla, with no significant broader media coverage or notable community controversy observed at the time of disclosure.