CVE-2026-84268

CVE-2026-84268 is a heap-based buffer overflow (CWE-122) in the SFTP backend (gvfsd-sftp) of gvfs, the GNOME Virtual File System. It is triggered when a user mounts a share and reads a file from a malicious SFTP server: the server supplies a length larger than the client requested, and read_reply() fails to validate that length against the allocated buffer size, writing past the buffer's boundaries. A successful attack corrupts adjacent heap memory in the gvfsd-sftp process, causing the process to abort (denial of service) or, potentially, allowing arbitrary code execution in the context of the affected user; the flaw is rated 8.8 (High) with network attack vector and user interaction required. Anyone running a Linux desktop with gvfs who connects to an untrusted or attacker-controlled SFTP server through the GNOME 'Connect to Server' functionality is affected. As of this analysis there is no known exploitation in the wild, no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.3% probability of exploitation in the next 30 days.

What to do: Apply gvfs package updates from your Linux distribution (e.g., Red Hat, Fedora, Ubuntu advisories) as soon as a patched version is published, since no fixed version number is stated in this disclosure. Until patched, avoid mounting or reading files over SFTP from untrusted or attacker-controlled servers via GNOME. If you do not use the SFTP 'Connect to Server' feature, your exposure is limited to the presence of the vulnerable code, and routine package updates will address it.