AI Security Summit: Join Figma, Perplexity & Wiz. [Register]

CVE-2026-84269
Linux Debian vulnerability analysis and mitigation

Overview

CVE-2026-84269 is a heap-based buffer overflow vulnerability in the AFP (Apple Filing Protocol) backend of GNOME's gvfs virtual filesystem library. When a user mounts an AFP share, a malicious AFP server can supply a DSI read response length that exceeds the client's pre-allocated reply buffer size, causing the gvfsd-afp process to crash. All gvfs versions prior to 1.60.2 are affected; Red Hat Enterprise Linux distributions shipping gvfs are also listed as affected. The vulnerability was published on September 1, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (Red Hat CVE, Github Advisory).

Technical details

The root cause is classified as CWE-122 (Heap-based Buffer Overflow): the DSI read path in the AFP backend (gvfsd-afp) does not validate the server-provided data length against the size of the pre-allocated reply buffer before copying data into it (Red Hat CVE, Red Hat Bugzilla). An attacker operating a rogue AFP server can craft a malicious DSI read response with an inflated length field, causing the client-side buffer to be overflowed on the heap. Exploitation requires user interaction — specifically, a user must connect to the attacker-controlled AFP server (e.g., by clicking a crafted afp:// URI). The GNOME GitLab issue tracker (issue #863) documents the flaw, though no public exploit code has been confirmed (GNOME GitLab).

Impact

Successful exploitation crashes the gvfsd-afp process, resulting in a denial of service for the affected user's AFP file-sharing access. There is no confirmed confidentiality or integrity impact under normal exploitation conditions; however, Red Hat notes that heap-based buffer overflows can theoretically be leveraged to overwrite function pointers and execute arbitrary code, though this is not the primary assessed impact for this vulnerability (Red Hat CVE). The scope is limited to the user-space gvfsd-afp daemon and does not directly affect the broader system or enable lateral movement.

Exploitability

No confirmed in-the-wild exploitation has been observed, and no functional proof-of-concept exploit code is publicly available — the referenced GNOME GitLab issue contains only metadata (GNOME GitLab). The NVD SSVC assessment classifies exploitation status as "poc" but Feedly's analysis found no real exploit artifacts at the linked URLs (Github Advisory). The EPSS score is approximately 0.249% (16th percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable as it requires user interaction to connect to a malicious AFP server.

Exploitation steps

  1. Set up a malicious AFP server: The attacker configures a rogue AFP server (e.g., using a modified Netatalk or custom DSI protocol implementation) that responds to DSI read requests with a crafted response where the reported data length exceeds the actual buffer size negotiated with the client.
  2. Lure the victim: The attacker delivers a crafted afp:// URI to the target user via phishing email, malicious web page, or social engineering, prompting the user to mount the attacker-controlled AFP share using a GNOME-based desktop environment.
  3. Trigger the overflow: When the user's system attempts to mount the share, gvfsd-afp initiates a DSI read operation. The malicious server returns a response with an inflated length field that exceeds the pre-allocated reply buffer.
  4. Crash gvfsd-afp: Because the AFP backend does not validate the server-provided length against the buffer size, the heap buffer is overflowed, causing gvfsd-afp to crash and denying the user AFP file-sharing functionality (Red Hat CVE, Red Hat Bugzilla).

Indicators of compromise

  • Logs: Unexpected crash or termination entries for the gvfsd-afp process in system logs (e.g., /var/log/syslog, journalctl) shortly after a user attempts to mount an AFP share.
  • Process: Absence or repeated restart of the gvfsd-afp daemon; core dump files generated for gvfsd-afp in /var/lib/systemd/coredump/ or /tmp/.
  • Network: Outbound connections from the user's workstation to an unfamiliar IP address on TCP port 548 (AFP/DSI protocol) preceding the crash event.
  • File System: Presence of core dump files associated with gvfsd-afp; GNOME error dialog artifacts or crash report files (e.g., in ~/.local/share/apport/) referencing the AFP daemon.

Mitigation and workarounds

Upgrade gvfs to version 1.60.2 or later, which contains the fix for this vulnerability (Red Hat Bugzilla). For Red Hat Enterprise Linux systems, apply the relevant errata when released by Red Hat. As an immediate workaround, Red Hat recommends not connecting to untrusted AFP servers; users should avoid clicking unsolicited afp:// links or mounting AFP shares from unknown sources (Red Hat CVE). Network-level controls such as firewall rules blocking outbound TCP port 548 to untrusted hosts can further reduce exposure.

Community reactions

Red Hat credited Keith Linneman (LinnemanLabs) for discovering and reporting this vulnerability (Red Hat CVE). Red Hat rated the severity as Moderate, noting that exploitation requires user interaction and the direct impact is limited to denial of service. No significant broader media coverage or notable community discussion beyond standard CVE tracking sites has been identified.

Additional resources

Linux Distribution fix status

Fix availability across major Linux distributions and their releases.

Debian

Fixed

bookworm

gvfs

Affected

sid

gvfs: 1.62.0-1

Fixed

trixie

gvfs

Affected

RHEL / CentOS

Affected

RHEL 8

gvfs.src

Affected

RHEL 9

gvfs.src

Affected

RHEL 10

gvfs.src

Affected

SourceThis report was generated using AI

Related Linux Debian vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2026-91990HIGH8.7
  • Linux Debian logoLinux Debian
  • python3-tornado
NoNoSep 15, 2026
CVE-2026-91992HIGH8.2
  • Linux Debian logoLinux Debian
  • python-tornado
NoNoSep 15, 2026
CVE-2026-91991MEDIUM6.3
  • Linux Debian logoLinux Debian
  • python-tornado
NoNoSep 15, 2026
CVE-2026-91986MEDIUM5.3
  • Linux Debian logoLinux Debian
  • rust-toolset:rhel8::rust-analyzer
NoNoSep 15, 2026
CVE-2026-48785MEDIUM4.8
  • Linux Debian logoLinux Debian
  • apptainer-sle15_7
NoYesSep 15, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management