CVE-2026-84268: 
Linux Debian Analyse et atténuation des vulnérabilités

CVE-2026-84268 is a heap-based buffer overflow vulnerability in the SFTP backend of gvfs (GNOME Virtual File System), specifically in the read_reply() function. When a user mounts an SFTP share and reads a file, a malicious SFTP server can supply a response length that exceeds the client's requested size; because the function does not validate the server-provided length against the allocated buffer, it writes past the buffer's intended boundaries. All gvfs versions are affected, with a fix introduced in version 1.60.2. The vulnerability was disclosed on September 1, 2026, and carries a CVSS v3.1 base score of 8.8 (High) (Red Hat Advisory, GitHub Advisory).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow): the read_reply() function in the gvfsd-sftp process accepts a server-controlled length value without verifying it against the size of the allocated heap buffer, allowing an out-of-bounds write into adjacent heap memory. Exploitation requires a user to connect to an attacker-controlled SFTP server — for example, by clicking a crafted sftp:// link or via an intercepted/unverified connection — making the attack vector network-based with required user interaction. The GNOME issue tracker entry (gitlab.gnome.org/GNOME/gvfs/-/issues/862) and Red Hat Bugzilla (bug 2526485) document the flaw; no public proof-of-concept exploit code has been identified at this time (Red Hat Advisory, Red Hat Bugzilla).

Successful exploitation can result in denial of service — the gvfsd-sftp process aborts upon detecting heap corruption — or potentially arbitrary code execution on the client system. All three security dimensions are rated High: confidentiality, integrity, and availability of the affected gvfsd-sftp process are fully at risk. Red Hat notes that default mitigations such as SELinux enforcement, ASLR, and NX memory protection significantly increase the difficulty of achieving arbitrary code execution in practice, but do not eliminate the risk (Red Hat Advisory).

No public proof-of-concept exploit code or active in-the-wild exploitation has been observed as of the disclosure date (Red Hat Advisory, GitHub Advisory). The NVD SSVC assessment confirms exploitation is currently "none" and the attack is not automatable, as it requires user interaction to connect to a malicious server. The EPSS score is 0.0, reflecting a very low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was reported by Keith Linneman of LinnemanLabs (Red Hat Advisory).

1. Set up a malicious SFTP server: The attacker configures a custom SFTP server implementation that responds to file read requests with a crafted reply containing a length field larger than the data actually requested by the client.
2. Lure the victim: The attacker delivers a crafted sftp:// URI to the target user (e.g., via phishing email, malicious web page, or document) or performs a man-in-the-middle attack on an unverified SFTP connection to redirect the client to the rogue server.
3. Trigger the mount and read: The victim's GNOME desktop (via gvfs) mounts the SFTP share and initiates a file read operation, causing gvfsd-sftp to call read_reply().
4. Exploit the overflow: The malicious server returns a response with an oversized length field. Because read_reply() does not validate this length against the allocated buffer, it writes attacker-controlled data past the buffer boundary into adjacent heap memory.
5. Achieve impact: Depending on heap layout and exploit precision, the outcome is either a process crash (DoS) when heap corruption is detected, or — with careful heap manipulation — overwriting of function pointers or other control-flow data to achieve arbitrary code execution in the context of the gvfsd-sftp process (Red Hat Advisory, Red Hat Bugzilla).

• Process: Unexpected crash or abort of the gvfsd-sftp process; core dump files generated in the user's home directory or /tmp associated with gvfsd-sftp.
• Logs: System journal (journalctl) entries showing gvfsd-sftp terminating with a signal (e.g., SIGABRT) after connecting to an SFTP server; glibc heap corruption detection messages such as *** glibc detected *** gvfsd-sftp: corrupted double-linked list.
• Network: Outbound SFTP connections (TCP port 22) to unfamiliar or unexpected IP addresses, particularly if initiated by a desktop session following user interaction with a link or file; unusual SFTP session patterns where the server sends oversized data payloads relative to client requests.
• File System: Unexpected core dump files (e.g., core, core.gvfsd-sftp.<pid>) in user-writable directories following SFTP mount attempts.

The vulnerability is fixed in gvfs version 1.60.2; users should upgrade to this version or later as soon as packages are available from their distribution (Red Hat Bugzilla). Red Hat Enterprise Linux users should monitor Red Hat advisories for updated gvfs packages and apply them promptly. As an immediate workaround, avoid connecting to untrusted or unverified SFTP servers; do not click unsolicited sftp:// links. If SFTP mounting via gvfs is not operationally required, consider disabling or restricting the capability. Red Hat also notes that SELinux, ASLR, and NX protections reduce the likelihood of successful arbitrary code execution even on unpatched systems (Red Hat Advisory).

Red Hat rated this vulnerability as "Important" severity and acknowledged the report from Keith Linneman of LinnemanLabs (Red Hat Advisory). Brief social media mentions appeared on Mastodon and Bluesky shortly after disclosure, consistent with routine CVE tracking activity rather than significant community alarm. No major security blog deep-dives or vendor statements beyond Red Hat's advisory have been identified at this time.