CVE-2026-84267
Received Received - Intake

Heap Memory Leak in GNOME gvfs SFTP Backend

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: redhat-SADP

Description
A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause read_string() to allocate a buffer with a certain length but the function does not verify that the buffer is completely filled, leaving the remainder of the buffer containing uninitialized heap contents. If the server sends a short FXP_HANDLE reply, these uninitialized bytes are taken as the file handle. The client will then echo these uninitialized bytes back to the server on all subsequent requests using that handle. With a length of 128 bytes, this issue allows the malicious server to deterministically read uninitialized heap memory from the gvfsd-sftp process, leaking its heap base and the load address of the libgio library, resulting in a deterministic defeat of Address Space Layout Randomization (ASLR).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-84267
EUVD
EUVD-2026-69296

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gnome gvfs *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-908 The product uses or accesses a resource that has not been initialized.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the SFTP backend of gvfs. A malicious SFTP server can exploit it by sending a short FXP_HANDLE reply during mounting. This causes read_string() to allocate a buffer but not fill it completely, leaving uninitialized heap memory. The client then uses this buffer as a file handle, leaking uninitialized memory back to the server. This can reveal heap base and library load addresses, breaking Address Space Layout Randomization (ASLR).

Detection Guidance

This vulnerability is specific to the gvfs SFTP backend and requires monitoring for unusual SFTP server responses or unexpected heap memory leaks. No direct detection commands are provided in the context. Check for uninitialized memory in gvfsd-sftp logs or use memory inspection tools if available.

Impact Analysis

An attacker could exploit this to read sensitive memory from the gvfsd-sftp process. This may expose internal data, including memory layout details, which could aid further attacks. While it does not directly allow code execution, it weakens system security by bypassing ASLR, making other exploits easier.

Compliance Impact

This vulnerability primarily affects system security by defeating ASLR, which could enable further exploits. It does not directly impact compliance with standards like GDPR or HIPAA unless such exploits lead to unauthorized data access or breaches. The confidentiality impact is low according to CVSS, but potential secondary effects on data protection may arise if the flaw is leveraged in an attack.

Mitigation Strategies

Disable or avoid using the SFTP backend in gvfs until a patch is available. Update gvfs to the latest version if a fix is released. Monitor vendor advisories for patches or workarounds.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84267. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart