
Cloud Vulnerability DB
A community-led vulnerabilities database
CVE-2026-84268 is a heap-based buffer overflow vulnerability in the SFTP backend of GNOME's gvfs (GNOME Virtual File System). A malicious SFTP server can cause the read_reply() function to process a server-provided length that exceeds the client's requested size, writing past the allocated buffer boundaries and corrupting adjacent heap memory in the gvfsd-sftp process. This can result in denial of service or potentially arbitrary code execution. All gvfs versions prior to 1.60.2 are affected, and Red Hat Enterprise Linux distributions shipping gvfs are also impacted. The vulnerability was disclosed on September 1, 2026, and carries a CVSS v3.1 base score of 8.8 (High) (Red Hat Advisory, Github Advisory).
The root cause is a missing bounds check in the read_reply() function of gvfs's SFTP backend (CWE-122: Heap-based Buffer Overflow). When a client mounts an SFTP share and reads a file, the server's response includes a length field; read_reply() does not validate this server-provided length against the size of the allocated receive buffer, allowing a write beyond the buffer's intended boundaries into adjacent heap memory. Exploitation requires the user to connect to a malicious SFTP server — for example, by clicking a crafted sftp:// link or via an intercepted/unverified connection — making user interaction a prerequisite. The vulnerability was reported by Keith Linneman (LinnemanLabs) and tracked in Red Hat Bugzilla as bug 2526485 (Red Hat Advisory, Red Hat Bugzilla).
Successful exploitation causes heap memory corruption in the gvfsd-sftp process, which at minimum results in a denial of service as the process aborts upon detecting the corruption. In more severe scenarios, a malicious SFTP server could leverage the heap overflow to overwrite function pointers or other critical memory structures, potentially achieving arbitrary code execution in the context of the user running gvfsd-sftp. Red Hat notes that default mitigations on RHEL — including SELinux enforcement, ASLR, and NX memory protection — significantly increase the difficulty of achieving arbitrary code execution, though the DoS impact remains straightforward (Red Hat Advisory).
As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.33%, indicating a low near-term probability of exploitation. Exploitation is not fully automated (automatable: no per NVD SSVC), as it requires user interaction — specifically, a user must connect to a malicious SFTP server (Red Hat Advisory).
length field larger than the data actually returned, exceeding the client's requested buffer size.sftp:// URI to the target user (e.g., via phishing email, malicious web page, or a man-in-the-middle attack on an unverified SFTP connection) to trigger the user's GNOME file manager or application to mount the malicious share.read_reply(), which processes the attacker-controlled length value without validating it against the allocated buffer size.read_reply() to write beyond the buffer boundary, corrupting adjacent heap memory — at minimum crashing the gvfsd-sftp process (DoS), or potentially overwriting heap metadata or function pointers for code execution.gvfsd-sftp process, or reliably cause a denial of service (Red Hat Advisory, Red Hat Bugzilla).gvfsd-sftp process; core dumps generated for gvfsd-sftp in /var/lib/systemd/coredump/ or /tmp/.journalctl) showing gvfsd-sftp terminated with a signal (e.g., SIGABRT or SIGSEGV); glibc heap corruption detection messages such as *** glibc detected *** gvfsd-sftp: malloc(): memory corruption.gvfsd-sftp process; connections originating from GNOME session processes to external hosts not in the organization's known SFTP server list.gvfsd-sftp; GNOME recently-used files (.local/share/recently-used.xbel) referencing unknown sftp:// URIs.The vulnerability is fixed in gvfs version 1.60.2; users should upgrade to this version or later as soon as packages are available for their distribution (Red Hat Bugzilla). A Fedora 43 advisory has been issued for the updated gvfs package. As an immediate workaround, Red Hat recommends not connecting to untrusted SFTP servers; organizations should restrict SFTP mounting to known, trusted servers only and consider disabling SFTP mounting capabilities entirely if not operationally required (Red Hat Advisory). On RHEL systems, existing security features (SELinux, ASLR, NX) provide partial mitigation against arbitrary code execution but do not prevent the DoS impact.
The vulnerability was reported to Red Hat by Keith Linneman of LinnemanLabs, who is acknowledged in the Red Hat advisory (Red Hat Advisory). Community discussion was observed on Reddit's r/pwnhub in a CVE daily brief post, and the CVE was noted on Bluesky by automated CVE tracking accounts. Coverage has been limited to aggregator and scanner platforms (Tenable Nessus, VulDB, LinuxSecurity.com), with no significant independent researcher commentary or major media coverage identified at this time.
Fix availability across major Linux distributions and their releases.
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."