The vulnerability arises from GNOME Shell's failure to validate the declared dimensions of icons received from remote search providers against the actual data buffer size. A malicious or compromised remote search provider can supply oversized icon dimensions, triggering an out-of-bounds read. This can cause the GNOME Shell process to crash, resulting in denial of service and potential disclosure of sensitive information from adjacent memory. The issue is tracked as CVE-2026-91786 and affects Red Hat Enterprise Linux 10. Red Hat has not provided an official patch or mitigation that meets their criteria for ease of use, applicability, and stability.

Successful exploitation can cause the GNOME Shell process to crash, disrupting the user's session (availability impact). Additionally, the out-of-bounds read may disclose sensitive information from adjacent memory, such as cryptographic keys or memory addresses, which could aid further attacks (confidentiality impact). The vulnerability does not affect integrity. The CVSS 3.1 base score is 6.1 (medium severity), with local attack vector, low complexity, no privileges required, user interaction required, unchanged scope, low confidentiality impact, no integrity impact, and high availability impact.

Currently, there is no available mitigation or official fix from Red Hat that meets their criteria for deployment and stability. Users should monitor Red Hat advisories for updates. Since no patch is available, mitigation options are limited. Customers with Red Hat Technical Account Managers (TAM) may consult them for guidance. Avoid interacting with untrusted remote search providers or disable related functionality if possible until a fix is released.