CVE-2026-84270
Received Received - Intake

Buffer Overflow in GNOME gvfs MTP Backend

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: redhat-SADP

Description
A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, do_read() in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested, this unrestricted length is passed directly to memcpy(). This causes the operation to read memory outside the intended boundaries. This allows an attacker who plugs in a malicious MTP device to cause a segmentation fault when a file is read and crash the gvfsd-mtp process, resulting in a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-84270
EUVD
EUVD-2026-69298

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gnome gvfs *
redhat gvfs 1.60.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read flaw in the gvfs MTP backend. When reading a file from a mounted MTP device, the do_read() function in gvfsbackendmtp.c trusts the data length provided by the device without validating it against the original request size. If a malicious device sends more bytes than requested, the unrestricted length is passed to memcpy(), causing the function to read memory outside intended boundaries. This can crash the gvfsd-mtp process and lead to a denial of service.

Detection Guidance

Detecting this vulnerability requires checking the installed version of gvfs. Run 'gvfs --version' to see if your version is below 1.60.2. If it is, the system is vulnerable. Also monitor for crashes in the gvfsd-mtp process when reading files from MTP devices.

Impact Analysis

An attacker with physical access to your device could exploit this by plugging in a malicious MTP device. If you attempt to read a file from it, the system may crash due to a segmentation fault, causing a denial of service. This requires user interaction to trigger but does not allow code execution or data theft.

Compliance Impact

This vulnerability primarily impacts system availability, which may affect compliance with regulations requiring data accessibility and service uptime, such as HIPAA for healthcare systems. GDPR compliance could be indirectly affected if the denial of service disrupts data processing activities, but there is no direct impact on data confidentiality or integrity.

Mitigation Strategies

Immediately update gvfs to version 1.60.2 or later. If updating is not possible, avoid using untrusted MTP devices. Disable MTP functionality if not required. Monitor system logs for gvfsd-mtp crashes as an indicator of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84270. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart