
Cloud Vulnerability DB
A community-led vulnerabilities database
CVE-2026-84269 is a heap-based buffer overflow vulnerability in the AFP (Apple Filing Protocol) backend of GNOME's gvfs virtual filesystem library. When a user mounts an AFP share, a malicious AFP server can supply a DSI read response length that exceeds the client's pre-allocated reply buffer size, causing the gvfsd-afp process to crash. All gvfs versions prior to 1.60.2 are affected; Red Hat Enterprise Linux is also listed as an affected platform. The vulnerability was disclosed on September 1, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (Red Hat Advisory, GitHub Advisory).
The root cause is classified as CWE-122 (Heap-based Buffer Overflow). In the AFP backend's DSI read path, the function responsible for processing server responses does not validate the server-provided data length against the size of the pre-allocated reply buffer. A malicious AFP server can return a length field that exceeds the buffer boundary, causing the client-side gvfsd-afp process to write beyond the intended heap region. Exploitation requires user interaction — specifically, a user must connect to a malicious AFP server (e.g., by clicking a crafted afp:// link). The GNOME GitLab issue tracker entry for this flaw is available at GNOME GitLab, and the Red Hat Bugzilla entry is tracked as Bug 2526784 (Red Hat Bugzilla).
Successful exploitation results in a crash of the gvfsd-afp process, causing a denial of service for the affected user's AFP file-sharing access. There is no confidentiality or integrity impact under the current CVSS assessment — the vulnerability does not expose sensitive data or allow unauthorized modification of files. However, Red Hat notes that heap-based buffer overflows can theoretically be leveraged for arbitrary code execution or function pointer overwriting in more complex scenarios, though this has not been demonstrated for this specific flaw (Red Hat Advisory).
No confirmed in-the-wild exploitation has been observed, and no weaponized exploit code is publicly available. The NVD SSVC assessment classifies exploitation status as "poc" (proof-of-concept level), though Feedly's analysis found no actual exploit code or reproduction steps in the referenced GNOME GitLab issue. The EPSS score is approximately 0.249%, placing it in the 16th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is limited by the requirement for user interaction — a victim must actively connect to a malicious AFP server (GitHub Advisory, Red Hat Advisory).
afp:// URI to the target user via phishing email, malicious web page, or social engineering, prompting them to mount the attacker-controlled AFP share.gvfsd-afp process initiates a DSI read request. The malicious server responds with an oversized length value in the DSI header.gvfsd-afp to crash and resulting in denial of service for the user's AFP access (Red Hat Advisory, GNOME GitLab).gvfsd-afp process; repeated restarts of gvfs daemon processes.journalctl) showing gvfsd-afp segmentation faults or abort signals; GNOME session logs referencing AFP mount failures.core or files in /var/lib/systemd/coredump/) associated with the gvfsd-afp binary.The vulnerability is fixed in gvfs version 1.60.2; users should upgrade to this version or later (Red Hat Bugzilla). A Fedora 43 advisory has been issued addressing this flaw. As an immediate workaround, Red Hat recommends not connecting to untrusted AFP servers; network-level controls such as firewall rules blocking outbound TCP port 548 to untrusted hosts can further reduce exposure (Red Hat Advisory). Organizations should also educate users not to click unsolicited afp:// links.
Red Hat credited Keith Linneman of LinnemanLabs for discovering and reporting this vulnerability (Red Hat Advisory). Red Hat rated the severity as Moderate, citing the requirement for user interaction and the limited direct impact (denial of service only) as mitigating factors. Coverage has been picked up by standard vulnerability tracking feeds including Tenable Nessus plugins, Linux Security advisories for Fedora, and automated CVE aggregators, but no significant independent researcher commentary or social media discussion has been identified beyond routine CVE publication notices.
Fix availability across major Linux distributions and their releases.
bionic (esm-infra)
gvfs
devel
gvfs
focal (esm-infra)
gvfs
jammy
gvfs
noble
gvfs
resolute
gvfs
xenial (esm-infra-legacy)
gvfs
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."