CVE-2026-84268: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-84268 is a heap-based buffer overflow vulnerability in the SFTP backend of GNOME's gvfs (GNOME Virtual File System). A malicious SFTP server can cause the read_reply() function to process a server-provided length that exceeds the client's requested size, writing past the allocated buffer boundaries and corrupting adjacent heap memory in the gvfsd-sftp process. This can result in denial of service or potentially arbitrary code execution. All gvfs versions prior to 1.60.2 are affected, and Red Hat Enterprise Linux distributions shipping gvfs are also impacted. The vulnerability was disclosed on September 1, 2026, and carries a CVSS v3.1 base score of 8.8 (High) (Red Hat Advisory, Github Advisory).

The root cause is a missing bounds check in the read_reply() function of gvfs's SFTP backend (CWE-122: Heap-based Buffer Overflow). When a client mounts an SFTP share and reads a file, the server's response includes a length field; read_reply() does not validate this server-provided length against the size of the allocated receive buffer, allowing a write beyond the buffer's intended boundaries into adjacent heap memory. Exploitation requires the user to connect to a malicious SFTP server — for example, by clicking a crafted sftp:// link or via an intercepted/unverified connection — making user interaction a prerequisite. The vulnerability was reported by Keith Linneman (LinnemanLabs) and tracked in Red Hat Bugzilla as bug 2526485 (Red Hat Advisory, Red Hat Bugzilla).

Successful exploitation causes heap memory corruption in the gvfsd-sftp process, which at minimum results in a denial of service as the process aborts upon detecting the corruption. In more severe scenarios, a malicious SFTP server could leverage the heap overflow to overwrite function pointers or other critical memory structures, potentially achieving arbitrary code execution in the context of the user running gvfsd-sftp. Red Hat notes that default mitigations on RHEL — including SELinux enforcement, ASLR, and NX memory protection — significantly increase the difficulty of achieving arbitrary code execution, though the DoS impact remains straightforward (Red Hat Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.33%, indicating a low near-term probability of exploitation. Exploitation is not fully automated (automatable: no per NVD SSVC), as it requires user interaction — specifically, a user must connect to a malicious SFTP server (Red Hat Advisory).

1. Set up a malicious SFTP server: The attacker configures a rogue SFTP server that responds to file read requests with a crafted reply containing a length field larger than the data actually returned, exceeding the client's requested buffer size.
2. Lure the victim: The attacker delivers a crafted sftp:// URI to the target user (e.g., via phishing email, malicious web page, or a man-in-the-middle attack on an unverified SFTP connection) to trigger the user's GNOME file manager or application to mount the malicious share.
3. Trigger the vulnerable code path: Once the user connects and attempts to read a file, the gvfsd-sftp process calls read_reply(), which processes the attacker-controlled length value without validating it against the allocated buffer size.
4. Heap corruption: The oversized length causes read_reply() to write beyond the buffer boundary, corrupting adjacent heap memory — at minimum crashing the gvfsd-sftp process (DoS), or potentially overwriting heap metadata or function pointers for code execution.
5. Achieve objective: Depending on heap layout and exploitation sophistication, the attacker may achieve arbitrary code execution in the context of the victim's gvfsd-sftp process, or reliably cause a denial of service (Red Hat Advisory, Red Hat Bugzilla).

• Process: Unexpected crash or abort of the gvfsd-sftp process; core dumps generated for gvfsd-sftp in /var/lib/systemd/coredump/ or /tmp/.
• Logs: System journal entries (via journalctl) showing gvfsd-sftp terminated with a signal (e.g., SIGABRT or SIGSEGV); glibc heap corruption detection messages such as *** glibc detected *** gvfsd-sftp: malloc(): memory corruption.
• Network: Outbound SFTP connections (TCP port 22) to unfamiliar or suspicious IP addresses initiated by the gvfsd-sftp process; connections originating from GNOME session processes to external hosts not in the organization's known SFTP server list.
• File System: Unexpected core dump files associated with gvfsd-sftp; GNOME recently-used files (.local/share/recently-used.xbel) referencing unknown sftp:// URIs.

The vulnerability is fixed in gvfs version 1.60.2; users should upgrade to this version or later as soon as packages are available for their distribution (Red Hat Bugzilla). A Fedora 43 advisory has been issued for the updated gvfs package. As an immediate workaround, Red Hat recommends not connecting to untrusted SFTP servers; organizations should restrict SFTP mounting to known, trusted servers only and consider disabling SFTP mounting capabilities entirely if not operationally required (Red Hat Advisory). On RHEL systems, existing security features (SELinux, ASLR, NX) provide partial mitigation against arbitrary code execution but do not prevent the DoS impact.

The vulnerability was reported to Red Hat by Keith Linneman of LinnemanLabs, who is acknowledged in the Red Hat advisory (Red Hat Advisory). Community discussion was observed on Reddit's r/pwnhub in a CVE daily brief post, and the CVE was noted on Bluesky by automated CVE tracking accounts. Coverage has been limited to aggregator and scanner platforms (Tenable Nessus, VulDB, LinuxSecurity.com), with no significant independent researcher commentary or major media coverage identified at this time.