GNOME 50.5 security fixes patch a gvfs CVE and Epiphany code injection
GNOME 50.5 patches gvfs CVE-2026-88924, Epiphany JavaScript injection and ZIP-slip extension flaws, plus use-after-free bugs in librsvg and GDM.
GNOME 50.5 shipped September 24 and updates 22 modules, with gvfs 1.60.3 carrying the only CVE identifier, CVE-2026-88924, which fixes socket ownership in the admin backend. Epiphany 50.6 fixes JavaScript code injection via a CSS selector in the autofill feature and a ZIP-slip path traversal in WebExtension XPI files, while 50.5 adds shell command quoting. librsvg 2.62.4 fixes a use-after-free triggered by duplicate XML entities in nested XInclude documents, and GDM 50.3 fixes two use-after-frees, one able to crash the session during screen lock or unlock.
- CVE-2026-88924 fixed in gvfs 1.60.3; admin backend now sets socket ownership before creation.
- Epiphany 50.6 patches autofill JavaScript injection and ZIP-slip path traversal in WebExtension XPI packages.
- librsvg 2.62.4 fixes use-after-free from duplicate XML entities; GDM 50.3 fixes two use-after-frees.
- Distributions shipping GNOME 50 must push packages for users to receive the fixes.
Vulnerabilities mentionedAll →
- CVE-2026-889247.0—TOCTOU symlink race in gvfs gvfsd-admin daemon allows local privilege escalation to rootpublished · GNOME gvfs (gvfsd-admin daemon / admin backend)
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-88924 | TOCTOU symlink race in gvfs gvfsd-admin daemon allows local privilege escalation to root gvfs, the GNOME virtual filesystem layer, contains a Time-of-Check Time-of-Use (TOCTOU) flaw in its privileged gvfsd-admin daemon, which follows links when changing ownership of the private D-Bus sockets it creates in a user-controlled directory. An authenticated local attacker can win a race and swap the socket path for a symlink to an arbitrary root-owned file, such as /etc/pam.d/su, causing the daemon to chown that file to the attacker's user ID. By corrupting ownership of critical system files, the attacker achieves full local privilege escalation to root. Any system shipping the vulnerable gvfs admin backend is affected, most notably GNOME-based Linux distributions. No public proof-of-concept or in-the-wild exploitation has been reported; the issue was coordinated by Red Hat as the assigning CNA. |
Full article409 words · extracted from helpnetsecurity.com · click to collapse
GNOME 50.5, which the GNOME Release Team shipped on September 24, patches a CVE in the gvfs file system layer, a JavaScript injection flaw in the Epiphany web browser and a use-after-free bug in the librsvg image library.
The release updates 22 modules. Users who browse with Epiphany, view SVG images through librsvg or reach files through gvfs keep these flaws until their distribution ships the new packages. “All operating systems shipping GNOME 50 are encouraged to upgrade,” the team wrote.
Epiphany closes a ZIP slip hole
Epiphany jumps from 50.4 to 50.6 in this release, picking up two August versions. Version 50.6, dated August 13, fixes JavaScript code injection through a CSS selector in the autofill feature and a path traversal flaw in WebExtension XPI files, labeled ZIPSLIP. In a ZIP slip attack, a crafted archive writes files outside the folder meant to hold it, so a malicious extension package could place files elsewhere on disk. Version 50.5 adds quoting to command line input before Epiphany hands it to a shell. The two versions also fix crashes in the password manager and on invalid bookmark imports.
One CVE, one line
gvfs 1.60.3 carries the only CVE identifier in the release notes, CVE-2026-88924. The fix makes the admin backend set ownership on its socket before creating it. The changelog gives that one line and no severity score, which leaves administrators to judge the risk from a single entry.
Memory bugs in images and the login screen
librsvg 2.62.4 fixes a use-after-free, a bug where a program keeps using memory it has already released. Duplicate XML entities in nested XInclude documents triggered it. The librsvg release also updates two Rust dependencies for advisories RUSTSEC-2026-0187 and RUSTSEC-2026-0204.
GDM 50.3, the login manager, fixes two use-after-free bugs, one of which could crash the whole user session during screen lock or unlock. It also repairs a regression in which an earlier security fix broke authentication on systemd. GNOME Shell 50.5 now refuses to unlock the screen after a screen time limit is reached, cancels mount password dialogs when the screen locks, and validates serialized image data before creating a pixbuf.
Two more libraries harden their file handling. libgsf 1.14.59 guards its OLE2 loader against runaway recursion and fixes zip reads on corrupted streams, and libsecret’s file backend gains file locking to stop concurrent writes from racing.
Get great free software: 20 open-source cybersecurity tools to keep your team ready for anything