Search: CVE-2026-84268

CVE-2026-84268 is a heap-based buffer overflow vulnerability in the SFTP backend of GNOME gvfs. A malicious SFTP server can send a length value exceeding the allocated buffer size during file read operations, causing memory corruption in the gvfsd-sftp process. This can lead to denial of service or potentially arbitrary code execution. The vulnerability affects gvfs versions prior to 1.60.2. Exploitation requires a user to connect to a malicious SFTP share. Security features like SELinux, ASLR, and NX help mitigate exploitation risks. A fix is available in gvfs version 1.60.2.