Read the docs
TI-2026-57921 Aliases CVE-2026-84268GHSA-8cxg-v7p7-qc7j

Gvfs: sftp: heap-based buffer overflow in read_reply()

Priority MEDIUM 41CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 18 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.

Summary

A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00622 50th percentileScored 2026-11-07
Fix Partial gvfs (GNOME): 1.60.2Red Hat: 11 advisoriesRed Hat: 18 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GNOMEgvfsbefore 1.60.21.60.2Patch availableCNA
Red HatRed Hat Enterprise Linux 10—1.54.4-4.el10_2.1Patch availableCNA
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—1.54.4-2.el10_0.2Patch availableCNA
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support—1.36.2-7.el7_9.1Patch availableCNA
Red HatRed Hat Enterprise Linux 8—1.36.2-22.el8_10Patch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—1.36.2-11.el8_4.1Patch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On—1.36.2-11.el8_4.1Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support—1.36.2-11.el8_6.1Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On—1.36.2-11.el8_6.1Patch availableCNA
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service—1.36.2-14.el8_8.1Patch availableCNA
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions—1.36.2-14.el8_8.1Patch availableCNA
Red HatRed Hat Enterprise Linux 9—1.48.1-8.el9_8.1Patch availableCNA
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—1.48.1-4.el9_2.1Patch availableCNA
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions—1.48.1-4.el9_4.1Patch availableCNA
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—1.48.1-6.el9_6.1Patch availableCNA
Red HatRed Hat Enterprise Linux 6——No fix listedCNA
  • gvfs VendorGNOME Affected before 1.60.2 Fixed in 1.60.2 Patch available CNA
  • Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 1.54.4-4.el10_2.1 Patch available CNA
  • Red Hat Enterprise Linux 10.0 Extended Update Support VendorRed Hat Affected — Fixed in 1.54.4-2.el10_0.2 Patch available CNA
  • Red Hat Enterprise Linux 7 Extended Lifecycle Support VendorRed Hat Affected — Fixed in 1.36.2-7.el7_9.1 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 1.36.2-22.el8_10 Patch available CNA
  • Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 1.36.2-11.el8_4.1 Patch available CNA
  • Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On VendorRed Hat Affected — Fixed in 1.36.2-11.el8_4.1 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 1.36.2-11.el8_6.1 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On VendorRed Hat Affected — Fixed in 1.36.2-11.el8_6.1 Patch available CNA
  • Red Hat Enterprise Linux 8.8 Telecommunications Update Service VendorRed Hat Affected — Fixed in 1.36.2-14.el8_8.1 Patch available CNA
  • Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1.36.2-14.el8_8.1 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 1.48.1-8.el9_8.1 Patch available CNA
  • Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1.48.1-4.el9_2.1 Patch available CNA
  • Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1.48.1-4.el9_4.1 Patch available CNA
  • Red Hat Enterprise Linux 9.6 Extended Update Support VendorRed Hat Affected — Fixed in 1.48.1-6.el9_6.1 Patch available CNA
  • Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA

CPE names CNA · 18

CPEVersionsRoleVendor
cpe:/o:redhat:enterprise_linux:10.210.2—Red Hat
cpe:/o:redhat:enterprise_linux_eus:10.010.0—Red Hat
cpe:/o:redhat:rhel_els:77—Red Hat
cpe:/a:redhat:enterprise_linux:8::appstream8—Red Hat
cpe:/a:redhat:enterprise_linux:8::crb8—Red Hat
cpe:/a:redhat:rhel_aus:8.4::appstream8.4—Red Hat
cpe:/a:redhat:rhel_eus_long_life:8.4::appstream8.4—Red Hat
cpe:/a:redhat:rhel_aus:8.6::appstream8.6—Red Hat
cpe:/a:redhat:rhel_eus_long_life:8.6::appstream8.6—Red Hat
cpe:/a:redhat:rhel_e4s:8.8::appstream8.8—Red Hat
  • cpe:/o:redhat:enterprise_linux:10.2 Versions 10.2 — ·Red Hat
  • cpe:/o:redhat:enterprise_linux_eus:10.0 Versions 10.0 — ·Red Hat
  • cpe:/o:redhat:rhel_els:7 Versions 7 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:8::appstream Versions 8 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:8::crb Versions 8 — ·Red Hat
  • cpe:/a:redhat:rhel_aus:8.4::appstream Versions 8.4 — ·Red Hat
  • cpe:/a:redhat:rhel_eus_long_life:8.4::appstream Versions 8.4 — ·Red Hat
  • cpe:/a:redhat:rhel_aus:8.6::appstream Versions 8.6 — ·Red Hat
  • cpe:/a:redhat:rhel_eus_long_life:8.6::appstream Versions 8.6 — ·Red Hat
  • cpe:/a:redhat:rhel_e4s:8.8::appstream Versions 8.8 — ·Red Hat
Show 8 more CPE
CPEVersionsRoleVendor
cpe:/a:redhat:rhel_tus:8.8::appstream8.8—Red Hat
cpe:/a:redhat:enterprise_linux:9::appstream9—Red Hat
cpe:/a:redhat:enterprise_linux:9::crb9—Red Hat
cpe:/a:redhat:rhel_e4s:9.2::appstream9.2—Red Hat
cpe:/a:redhat:rhel_e4s:9.4::appstream9.4—Red Hat
cpe:/a:redhat:rhel_eus:9.6::appstream9.6—Red Hat
cpe:/a:redhat:rhel_eus:9.6::crb9.6—Red Hat
cpe:/o:redhat:rhel_els:66—Red Hat
  • cpe:/a:redhat:rhel_tus:8.8::appstream Versions 8.8 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:9::appstream Versions 9 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:9::crb Versions 9 — ·Red Hat
  • cpe:/a:redhat:rhel_e4s:9.2::appstream Versions 9.2 — ·Red Hat
  • cpe:/a:redhat:rhel_e4s:9.4::appstream Versions 9.4 — ·Red Hat
  • cpe:/a:redhat:rhel_eus:9.6::appstream Versions 9.6 — ·Red Hat
  • cpe:/a:redhat:rhel_eus:9.6::crb Versions 9.6 — ·Red Hat
  • cpe:/o:redhat:rhel_els:6 Versions 6 — ·Red Hat

Remediation

  • Fix · CNA gvfs (GNOME) Fixed in 1.60.2

Red Hat 11 advisories

  • RHSA-2026:86606 Released 2026-10-21 · Red Hat rating Important
    gvfs security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) gvfs-1.36.2-7.el7_9.1, gvfs-1.36.2-7.el7_9.1.ppc, gvfs-afc-1.36.2-7.el7_9.1 +11
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) gvfs-tests-1.36.2-7.el7_9.1
  • RHSA-2026:85939 Released 2026-10-20 · Red Hat rating Important
    gvfs security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) gvfs-1.48.1-6.el9_6.1
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) gvfs-1.48.1-6.el9_6.1, gvfs-client-1.48.1-6.el9_6.1, gvfs-devel-1.48.1-6.el9_6.1 +5
  • RHSA-2026:85944 Released 2026-10-20 · Red Hat rating Important
    gvfs security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) gvfs-1.48.1-4.el9_4.1, gvfs-client-1.48.1-4.el9_4.1, gvfs-devel-1.48.1-4.el9_4.1 +5
Show 8 more Red Hat advisories
  • RHSA-2026:85941 Released 2026-10-20 · Red Hat rating Important
    gvfs security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) gvfs-1.54.4-2.el10_0.2, gvfs-client-1.54.4-2.el10_0.2, gvfs-fuse-1.54.4-2.el10_0.2 +4
  • RHSA-2026:85940 Released 2026-10-20 · Red Hat rating Important
    gvfs security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) gvfs-1.36.2-14.el8_8.1, gvfs-afc-1.36.2-14.el8_8.1, gvfs-afp-1.36.2-14.el8_8.1 +8
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) gvfs-1.36.2-14.el8_8.1, gvfs-afc-1.36.2-14.el8_8.1, gvfs-afp-1.36.2-14.el8_8.1 +8
  • RHSA-2026:85942 Released 2026-10-20 · Red Hat rating Important
    gvfs security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) gvfs-1.48.1-4.el9_2.1, gvfs-client-1.48.1-4.el9_2.1, gvfs-devel-1.48.1-4.el9_2.1 +5
  • RHSA-2026:85943 Released 2026-10-20 · Red Hat rating Important
    gvfs security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) gvfs-1.36.2-11.el8_6.1, gvfs-afc-1.36.2-11.el8_6.1, gvfs-afp-1.36.2-11.el8_6.1 +8
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) gvfs-1.36.2-11.el8_6.1, gvfs-afc-1.36.2-11.el8_6.1, gvfs-afp-1.36.2-11.el8_6.1 +8
  • RHSA-2026:85945 Released 2026-10-20 · Red Hat rating Important
    gvfs security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) gvfs-1.36.2-11.el8_4.1, gvfs-afc-1.36.2-11.el8_4.1, gvfs-afp-1.36.2-11.el8_4.1 +8
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) gvfs-1.36.2-11.el8_4.1, gvfs-afc-1.36.2-11.el8_4.1, gvfs-afp-1.36.2-11.el8_4.1 +8
  • RHSA-2026:74370 Released 2026-10-01 · Red Hat rating Important
    gvfs security update
    • Red Hat Enterprise Linux AppStream (v. 9) gvfs-1.48.1-8.el9_8.1, gvfs-client-1.48.1-8.el9_8.1, gvfs-devel-1.48.1-8.el9_8.1 +5
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) gvfs-1.48.1-8.el9_8.1
  • RHSA-2026:73998 Released 2026-09-30 · Red Hat rating Important
    gvfs security update
    • Red Hat Enterprise Linux AppStream (v. 10) gvfs-1.54.4-4.el10_2.1, gvfs-client-1.54.4-4.el10_2.1, gvfs-fuse-1.54.4-4.el10_2.1 +4
  • RHSA-2026:73997 Released 2026-09-30 · Red Hat rating Important
    gvfs security update
    • Red Hat Enterprise Linux AppStream (v. 8) gvfs-1.36.2-22.el8_10, gvfs-afc-1.36.2-22.el8_10, gvfs-afp-1.36.2-22.el8_10 +8
    • Red Hat Enterprise Linux CRB (v. 8) gvfs-1.36.2-22.el8_10

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    GNOME gvfs 1.60.2

    4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-57922 Gvfs: afp: heap-based buffer overflow in dsi read pathPriority MEDIUM 62
    • TI-2026-57920 Gvfs: sftp: uninitialized heap disclosure in read_string()Priority MEDIUM 53
    • TI-2026-57923 Gvfs: mtp: out-of-bounds read in do_read()Priority LOW 19
    Show all 4 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:85939
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:73998
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:73997
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:74370
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:85945
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:85943
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:85940
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:85942
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:85944
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:85941
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:85939
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:85945
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:85943
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:85940
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:73997
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:74370
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2026:86606
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2026:86606

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-84268
  2. 2026-10-03 Alias added: GHSA-8cxg-v7p7-qc7j
  3. 2026-10-16 Affected versions changed · CNA
  4. 2026-10-16 Affected versions changed · Red Hat
  5. 2026-10-20 Fix available: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) · Red Hat
  6. 2026-10-20 Fix available: gvfs@0:1.36.2-11.el8_6.1, gvfs@0:1.36.2-14.el8_8.1, gvfs@0:1.48.1-4.el9_2.1 +2 · CNA
  7. 2026-10-20 5 new references · CNA
  8. 2026-10-20 Fix available: gvfs@0:1.36.2-11.el8_4.1 · CNA
  9. 2026-10-20 1 new reference · CNA
  10. 2026-10-20 Fix available: RHSA-2026:85941 · Red Hat
  11. 2026-10-20 Fix available: RHSA-2026:85942 · Red Hat
  12. 2026-10-20 Fix available: RHSA-2026:85940 · Red Hat
  13. 2026-10-20 Fix available: RHSA-2026:85943 · Red Hat
  14. 2026-10-20 Fix available: RHSA-2026:85944 · Red Hat
  15. 2026-10-20 Fix available: RHSA-2026:85945 · Red Hat
  16. 2026-10-21 Fix available: gvfs@0:1.36.2-7.el7_9.1, gvfs@0:1.48.1-6.el9_6.1 · CNA
  17. 2026-10-21 2 new references · CNA
  18. 2026-10-21 Fix available: RHSA-2026:85939 · Red Hat
  19. 2026-10-21 Fix available: RHSA-2026:86606 · Red Hat
  20. 2026-10-21 Fix available: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream E4S (v.8.8) +8 · Red Hat
  21. 2026-11-06 EPSS moved to the 50th–90th percentile

References

Advisory 11

Other 3

  • TI-2023-23091 Gnome-maps: gnome maps is vulnerable to a code injection attack (similar to xss) via its service.json CVSS 3.1CRITICAL 9.8
  • TI-2026-41775 Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" CVSS 3.1HIGH 8.6
  • TI-2026-41772 Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime CVSS 3.1HIGH 7.5
  • TI-2026-03716 Libsoup: libsoup: denial of service via use-after-free in http/2 server CVSS 3.1HIGH 7.5
  • TI-2024-28393 Integer overflow in GNOME G Structured File Library CVSS 3.1HIGH 8.4
  • TI-2024-24253 Integer overflow in GNOME G Structured File Library CVSS 3.1HIGH 8.4
See all 402 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences