CVE-2026-84269: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-84269 is a heap-based buffer overflow vulnerability in the AFP (Apple Filing Protocol) backend of GNOME's gvfs virtual filesystem library. When a user mounts an AFP share, a malicious AFP server can supply a DSI read response length that exceeds the client's pre-allocated reply buffer size, causing the gvfsd-afp process to crash. All gvfs versions prior to 1.60.2 are affected; Red Hat Enterprise Linux distributions shipping gvfs are also listed as affected. The vulnerability was published on September 1, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (Red Hat CVE, Github Advisory).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow): the DSI read path in the AFP backend (gvfsd-afp) does not validate the server-provided data length against the size of the pre-allocated reply buffer before copying data into it (Red Hat CVE, Red Hat Bugzilla). An attacker operating a rogue AFP server can craft a malicious DSI read response with an inflated length field, causing the client-side buffer to be overflowed on the heap. Exploitation requires user interaction — specifically, a user must connect to the attacker-controlled AFP server (e.g., by clicking a crafted afp:// URI). The GNOME GitLab issue tracker (issue #863) documents the flaw, though no public exploit code has been confirmed (GNOME GitLab).

Successful exploitation crashes the gvfsd-afp process, resulting in a denial of service for the affected user's AFP file-sharing access. There is no confirmed confidentiality or integrity impact under normal exploitation conditions; however, Red Hat notes that heap-based buffer overflows can theoretically be leveraged to overwrite function pointers and execute arbitrary code, though this is not the primary assessed impact for this vulnerability (Red Hat CVE). The scope is limited to the user-space gvfsd-afp daemon and does not directly affect the broader system or enable lateral movement.

No confirmed in-the-wild exploitation has been observed, and no functional proof-of-concept exploit code is publicly available — the referenced GNOME GitLab issue contains only metadata (GNOME GitLab). The NVD SSVC assessment classifies exploitation status as "poc" but Feedly's analysis found no real exploit artifacts at the linked URLs (Github Advisory). The EPSS score is approximately 0.249% (16th percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable as it requires user interaction to connect to a malicious AFP server.

1. Set up a malicious AFP server: The attacker configures a rogue AFP server (e.g., using a modified Netatalk or custom DSI protocol implementation) that responds to DSI read requests with a crafted response where the reported data length exceeds the actual buffer size negotiated with the client.
2. Lure the victim: The attacker delivers a crafted afp:// URI to the target user via phishing email, malicious web page, or social engineering, prompting the user to mount the attacker-controlled AFP share using a GNOME-based desktop environment.
3. Trigger the overflow: When the user's system attempts to mount the share, gvfsd-afp initiates a DSI read operation. The malicious server returns a response with an inflated length field that exceeds the pre-allocated reply buffer.
4. Crash gvfsd-afp: Because the AFP backend does not validate the server-provided length against the buffer size, the heap buffer is overflowed, causing gvfsd-afp to crash and denying the user AFP file-sharing functionality (Red Hat CVE, Red Hat Bugzilla).

• Logs: Unexpected crash or termination entries for the gvfsd-afp process in system logs (e.g., /var/log/syslog, journalctl) shortly after a user attempts to mount an AFP share.
• Process: Absence or repeated restart of the gvfsd-afp daemon; core dump files generated for gvfsd-afp in /var/lib/systemd/coredump/ or /tmp/.
• Network: Outbound connections from the user's workstation to an unfamiliar IP address on TCP port 548 (AFP/DSI protocol) preceding the crash event.
• File System: Presence of core dump files associated with gvfsd-afp; GNOME error dialog artifacts or crash report files (e.g., in ~/.local/share/apport/) referencing the AFP daemon.

Upgrade gvfs to version 1.60.2 or later, which contains the fix for this vulnerability (Red Hat Bugzilla). For Red Hat Enterprise Linux systems, apply the relevant errata when released by Red Hat. As an immediate workaround, Red Hat recommends not connecting to untrusted AFP servers; users should avoid clicking unsolicited afp:// links or mounting AFP shares from unknown sources (Red Hat CVE). Network-level controls such as firewall rules blocking outbound TCP port 548 to untrusted hosts can further reduce exposure.

Red Hat credited Keith Linneman (LinnemanLabs) for discovering and reporting this vulnerability (Red Hat CVE). Red Hat rated the severity as Moderate, noting that exploitation requires user interaction and the direct impact is limited to denial of service. No significant broader media coverage or notable community discussion beyond standard CVE tracking sites has been identified.