8.8

CVE-2026-84268

Gvfs: sftp: heap-based buffer overflow in read_reply()

A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerGNOME
≫
Produkt gvfs
Default Statusunaffected
Version 0
Version < 1.60.2
Status affected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 10
Default Statusaffected
Version 0:1.54.4-4.el10_2.1
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 8
Default Statusaffected
Version 0:1.36.2-22.el8_10
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 9
Default Statusaffected
Version 0:1.48.1-8.el9_8.1
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 6
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 7
Default Statusaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.33% 0.253
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
RedHat 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-122 Heap-based Buffer Overflow

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

https://access.redhat.com/security/cve/CVE-2026-84268
https://bugzilla.redhat.com/show_bug.cgi?id=2526485
https://gitlab.gnome.org/GNOME/gvfs/-/issues/862
https://access.redhat.com/errata/RHSA-2026:73997
https://access.redhat.com/errata/RHSA-2026:73998
https://access.redhat.com/errata/RHSA-2026:74370