Threats Tagged 'cve-2026-84269'

CVE-2026-84267 is a vulnerability in the SFTP backend of GNOME gvfs where a malicious SFTP server can cause the client to leak uninitialized heap memory. This occurs because the read_string() function allocates a buffer without verifying it is fully filled, leading to uninitialized bytes being used as a file handle and echoed back to the server. The leaked memory includes the heap base and the load address of the libgio library, allowing deterministic defeat of ASLR. The vulnerability requires user interaction to connect to a malicious SFTP share and results in limited information disclosure without exposing user data. It has been rated with moderate severity and affects gvfs versions from 1.10.0 up to but not including 1.60.2.

A flaw was found in the AFP backend in gvfs. When mounting a share, a malicious AFP server can cause the DSI read path to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the pre-sized reply buffer, causing the operation to access past the intended boundaries. This issue allows a malicious server to overflow a heap buffer and crash the gvfsd-afp process, resulting in a denial of service.