CVE-2026-84270: Out-of-bounds Read in GNOME gvfs

The vulnerability exists in the MTP backend of GNOME gvfs, specifically in the do_read() function within gvfsbackendmtp.c. The function trusts the data length returned by the MTP device without limiting it to the originally requested size. If a malicious MTP device returns more bytes than requested, this length is used directly in a memcpy() call, causing an out-of-bounds read. This results in a segmentation fault and crashes the gvfsd-mtp process, causing denial of service. Exploitation requires physical access to connect a malicious MTP device. The vulnerability has a CVSS v3.1 base score of 4.3 (medium severity) with an attack vector of physical, low attack complexity, no privileges required, and user interaction required. There is no confidentiality or integrity impact, only availability impact. The Red Hat advisory does not confirm a patch or fix availability and recommends mitigation by not connecting untrusted MTP devices.

An attacker with physical access can cause a denial of service by plugging in a malicious MTP device that triggers an out-of-bounds read in the gvfsd-mtp process, crashing it. There is no impact on confidentiality or integrity. The vulnerability does not lead to information disclosure or code execution. The main impact is availability loss due to process crash.

According to the Red Hat advisory, the primary mitigation is to avoid connecting untrusted or unknown MTP devices to the system. No official patch or fix is currently confirmed. Users should monitor the vendor advisory for updates on patch availability. No other specific mitigations are recommended at this time.