CVE-2026-84267: Use of Uninitialized Resource in GNOME gvfs

The vulnerability in GNOME gvfs's SFTP backend arises from read_string() allocating a buffer that may contain uninitialized heap contents if the server sends a short FXP_HANDLE reply. These uninitialized bytes are used as the file handle and echoed back to the server on subsequent requests, enabling a malicious SFTP server to read uninitialized heap memory from the gvfsd-sftp process. This memory leak reveals the heap base and the load address of the libgio library, effectively defeating ASLR deterministically. Exploitation requires a user to connect to a malicious SFTP share, such as by clicking a crafted sftp:// link or intercepting an unverified connection. The direct impact is limited to information disclosure of specific memory contents and does not expose user data. The vulnerability affects gvfs versions >=1.10.0 and <1.60.2. Red Hat rates this issue as moderate severity with a CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).

The vulnerability allows a malicious SFTP server to read uninitialized heap memory from the gvfsd-sftp client process, leaking the heap base and the load address of the libgio library. This information leak enables deterministic defeat of ASLR, which could potentially aid further exploitation. However, the vulnerability does not expose user data and requires user interaction to connect to a malicious SFTP server. The overall impact is limited to low confidentiality loss with no integrity or availability impact.

The vendor advisory recommends not connecting to untrusted SFTP servers to mitigate this vulnerability. There is no indication that an official patch or fix is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid accessing SFTP shares from untrusted or unknown sources to prevent exploitation.