CVE-2026-84268: Heap-based Buffer Overflow in GNOME gvfs

The vulnerability exists in the SFTP backend of GNOME gvfs, specifically in the read_reply() function. When mounting a share and reading a file, a malicious SFTP server can send a length value larger than the buffer allocated by the client. The function does not verify this length against the buffer size, causing a heap-based buffer overflow. This overflow corrupts adjacent heap memory in the gvfsd-sftp process, which may lead to process termination or arbitrary code execution. The issue affects gvfs versions from 0 up to but not including 1.60.2. Red Hat has issued a security advisory and released patches for affected Red Hat Enterprise Linux 8 variants.

A malicious SFTP server can exploit this vulnerability to corrupt heap memory in the gvfsd-sftp process. This can cause the process to abort, resulting in denial of service, or potentially allow an attacker to execute arbitrary code with the privileges of the gvfsd-sftp process. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality, integrity, and availability impacts.

A security update fixing this vulnerability is available and should be applied. Red Hat has released patched gvfs packages for Red Hat Enterprise Linux 8, including various architectures and extended life cycle versions. Users should follow the update instructions provided by Red Hat in their advisory (https://access.redhat.com/articles/11258) to remediate this issue. No additional mitigations are indicated by the vendor advisory.