
Cloud Vulnerability DB
A community-led vulnerabilities database
CVE-2026-84270 is an out-of-bounds read vulnerability in the MTP (Media Transfer Protocol) backend of GNOME's gvfs virtual filesystem library. The flaw exists in the do_read() function within gvfsbackendmtp.c, which trusts the data length returned by a connected MTP device without validating it against the originally requested size. All gvfs versions prior to 1.60.2 are affected, with Red Hat Enterprise Linux also listed as an affected platform. The vulnerability was published on September 1, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat Advisory, Github Advisory).
The root cause is classified as CWE-125 (Out-of-bounds Read). When a file is read from a mounted MTP device, do_read() in gvfsbackendmtp.c accepts the data length value returned by the device at face value and passes it directly to memcpy() without capping it to the size originally requested by the client. If a malicious MTP device returns a length larger than expected, memcpy() reads memory beyond the intended buffer boundaries, triggering a segmentation fault and crashing the gvfsd-mtp process. Exploitation requires physical access — an attacker must plug in a specially crafted MTP device — and user interaction (a file read operation must be initiated) (Red Hat Advisory, Red Hat Bugzilla).
Successful exploitation causes the gvfsd-mtp daemon to crash via a segmentation fault, resulting in a denial of service for MTP device access. There is no confidentiality or integrity impact — the vulnerability does not expose sensitive data or allow modification of files. The scope is limited to the gvfsd-mtp process and does not enable lateral movement or privilege escalation (Red Hat Advisory).
No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.15%, placing it in the 4th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is inherently limited by the requirement for physical device access, making mass exploitation impractical (Github Advisory, Feedly).
do_read() in gvfsbackendmtp.c processes the device's inflated length value and passes it to memcpy(), memory is read out of bounds, causing a segmentation fault and crashing the gvfsd-mtp process — resulting in denial of service (Red Hat Advisory, Red Hat Bugzilla).gvfsd-mtp process; absence of the gvfsd-mtp process after connecting an MTP device./var/log/syslog or journalctl) referencing gvfsd-mtp; core dump files generated for the gvfsd-mtp process.core or gvfsd-mtp.core) in the working directory or configured core dump location.dmesg) showing an unrecognized or unusual MTP device being attached (Red Hat Advisory).Update gvfs to version 1.60.2 or later, which contains the fix for this vulnerability (Red Hat Bugzilla). As an immediate workaround, Red Hat recommends not connecting untrusted or unknown MTP devices to affected systems (Red Hat Advisory). Additionally, organizations can enforce USB device allow-listing policies (e.g., via udev rules or endpoint security tools) to prevent unauthorized MTP devices from being mounted. Fedora users should apply the available update referenced in the Fedora security advisory (Linux Security).
Red Hat rated this vulnerability as Moderate severity, noting that physical access requirements and the denial-of-service-only impact limit its overall risk (Red Hat Advisory). Red Hat credited Keith Linneman of LinnemanLabs for responsibly reporting the issue. Community discussion has been minimal given the low EPSS score and physical access requirement, with automated CVE tracking bots on platforms like Bluesky noting the disclosure.
Fix availability across major Linux distributions and their releases.
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."