Skip to content
Heist/ feed
Back to feed
High

Gvfs: sftp: heap-based buffer overflow in read_reply()

Type: advisorySources: OSV

A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-84268
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 20:45 UTC · Revision 1

Source evidence

Gvfs: sftp: heap-based buffer overflow in read_reply()

core-osv · Original source

Published 1 Sept 2026, 15:15 UTC

A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution.

osv:CVE-2026-84268
Complete source record
{
  "id": "93244f72103d529db0dc468037e09f11ae9338c61490511e9d67303df5bb31e8",
  "url": "https://osv.dev/vulnerability/CVE-2026-84268",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Gvfs: sftp: heap-based buffer overflow in read_reply()",
    "summary": "A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution.",
    "evidence": "osv:CVE-2026-84268",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-84268",
      "aliases": [
        "CVE-2026-84268"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://gitlab.gnome.org/gnome/gvfs",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "5651571370400cf0a114f61af2fa96e0ff4784d5"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.60.2"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  }
                ]
              }
            }
          ],
          "versions": [
            "1.60.1",
            "1.60.0",
            "1.59.90",
            "1.59.1",
            "1.58.0",
            "1.57.2",
            "1.57.1",
            "1.56.1",
            "1.56.0",
            "1.55.90",
            "1.55.1",
            "1.54.1",
            "1.54.0",
            "1.53.91",
            "1.53.90",
            "1.53.1",
            "1.52.1",
            "1.52.0",
            "1.51.91",
            "1.51.90",
            "1.51.1",
            "1.50.4",
            "1.50.3",
            "1.50.2",
            "1.50.1",
            "1.50.0",
            "1.49.90",
            "1.49.1",
            "1.48.1",
            "1.48.0",
            "1.47.91",
            "1.47.90",
            "1.47.1",
            "1.46.1",
            "1.46.0",
            "1.45.92",
            "1.45.90",
            "1.45.3",
            "1.45.2",
            "1.44.1",
            "1.44.0",
            "1.43.92",
            "1.43.91",
            "1.43.90",
            "1.43.2",
            "1.43.1",
            "1.42.0",
            "1.41.91",
            "1.41.90",
            "1.41.4",
            "1.41.3",
            "1.41.2",
            "1.41.1",
            "1.40.0",
            "1.39.92",
            "1.39.91",
            "1.39.90",
            "1.39.4",
            "1.39.3",
            "1.39.1",
            "1.38.0",
            "1.37.91",
            "1.37.90",
            "1.37.4",
            "1.37.2",
            "1.37.1",
            "1.36.0",
            "1.35.92",
            "1.35.91",
            "1.35.90",
            "1.35.4",
            "1.35.3",
            "1.35.2",
            "1.35.1",
            "1.34.0",
            "1.33.92",
            "1.33.91",
            "1.33.90",
            "1.33.3",
            "1.33.1",
            "1.32.0",
            "1.31.92",
            "1.31.91",
            "1.31.90",
            "1.31.4",
            "1.31.3",
            "1.31.2",
            "1.31.1",
            "1.30.0",
            "1.29.92",
            "1.29.91",
            "1.29.90",
            "1.29.4",
            "1.29.3",
            "1.29.2",
            "1.29.1",
            "1.28.1",
            "1.28.0",
            "1.27.92",
            "1.27.91",
            "1.27.90",
            "1.27.4",
            "1.27.3",
            "1.26.2",
            "1.26.1.1",
            "1.26.1",
            "1.26.0",
            "1.25.92",
            "1.25.91",
            "1.25.90",
            "1.25.4.1",
            "1.25.4",
            "1.25.3",
            "1.25.2",
            "1.25.1",
            "1.24.0",
            "1.23.92",
            "1.23.90",
            "1.23.4",
            "1.23.3",
            "1.23.2",
            "1.23.1",
            "1.22.0",
            "1.21.92",
            "1.21.90",
            "1.21.4",
            "1.21.3",
            "1.21.2",
            "1.21.1",
            "1.20.0",
            "1.19.90",
            "1.19.5",
            "1.19.4",
            "1.19.3",
            "1.19.2",
            "1.19.1",
            "1.18.2",
            "1.18.1",
            "1.18.0",
            "1.17.90",
            "1.17.3",
            "1.17.2",
            "1.17.1",
            "1.17.0",
            "1.16.0",
            "1.15.4",
            "1.15.3",
            "1.15.2",
            "1.14.0",
            "1.15.1",
            "1.15.0",
            "1.13.9",
            "1.13.8",
            "1.13.7",
            "1.13.6",
            "1.13.5",
            "1.13.4",
            "1.13.3",
            "1.13.2",
            "1.13.1",
            "1.13.0",
            "1.12.1",
            "1.12.0",
            "1.11.5",
            "1.11.4",
            "1.11.3",
            "1.10.0",
            "1.9.5",
            "1.9.4",
            "1.9.3",
            "1.9.2",
            "1.9.1",
            "1.9.0",
            "1.7.3",
            "1.7.2",
            "1.7.1",
            "1.7.0",
            "1.6.5",
            "1.6.4",
            "1.6.3",
            "1.6.2",
            "1.6.1",
            "1.6.0",
            "1.5.5",
            "1.5.4",
            "1.5.3",
            "1.5.2",
            "1.5.1",
            "1.4.0",
            "1.3.6",
            "1.3.5",
            "1.3.4",
            "1.3.3",
            "1.3.2",
            "1.3.1",
            "GVFS_1_2_2",
            "GVFS_1_2_1",
            "GVFS_1_1_8",
            "GVFS_1_1_7",
            "GVFS_1_1_6",
            "GVFS_1_1_5",
            "GVFS_1_1_4",
            "GVFS_1_1_3",
            "GVFS_1_1_2",
            "GVFS_1_1_1",
            "GVFS_0_99_7",
            "GVFS_0_99_6",
            "GVFS_0_99_5",
            "GVFS_0_99_4",
            "GVFS_0_99_3",
            "GVFS_0_99_2",
            "GVFS_0_99_1",
            "GVFS_0_2_4",
            "GVFS_0_2_2",
            "GVFS_0_2_1",
            "GVFS_0_2_0_1",
            "GVFS_0_2_0",
            "GVFS_0_1_11",
            "GVFS_0_1_10",
            "GVFS_0_1_9",
            "GVFS_0_1_8",
            "GVFS_0_1_7",
            "GVFS_0_1_6",
            "GVFS_0_1_5",
            "GVFS_0_1_4",
            "GVFS_0_1_3",
            "GVFS_0_1_2",
            "GVFS_0_1_1",
            "GVFS_0_1_0",
            "GVFS_0_0_2",
            "GVFS_0_0_1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84268.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:51.449605492Z",
      "provider": "osv",
      "references": [
        "https://access.redhat.com/downloads/content/package-browser/",
        "https://access.redhat.com/errata/RHSA-2026:73997",
        "https://access.redhat.com/errata/RHSA-2026:73998",
        "https://access.redhat.com/errata/RHSA-2026:74370",
        "https://access.redhat.com/errata/RHSA-2026:85939",
        "https://access.redhat.com/errata/RHSA-2026:85940",
        "https://access.redhat.com/errata/RHSA-2026:85941",
        "https://access.redhat.com/errata/RHSA-2026:85942",
        "https://access.redhat.com/errata/RHSA-2026:85943",
        "https://access.redhat.com/errata/RHSA-2026:85944",
        "https://access.redhat.com/errata/RHSA-2026:85945",
        "https://access.redhat.com/errata/RHSA-2026:86606",
        "https://access.redhat.com/security/cve/CVE-2026-84268",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84268.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-84268",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2526485",
        "https://gitlab.gnome.org/GNOME/gvfs/-/issues/862",
        "https://gitlab.gnome.org/GNOME/gvfs"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-122"
        ],
        "cna_assigner": "redhat",
        "unresolved_ranges": [
          {
            "extracted_events": [
              {
                "range": [
                  {
                    "fixed": "0:1.54.4-4.el10_2.1"
                  },
                  {
                    "fixed": "0:1.54.4-2.el10_0.2"
                  },
                  {
                    "fixed": "0:1.36.2-7.el7_9.1"
                  },
                  {
                    "fixed": "0:1.36.2-22.el8_10"
                  },
                  {
                    "fixed": "0:1.36.2-11.el8_4.1"
                  },
                  {
                    "fixed": "0:1.36.2-11.el8_4.1"
                  },
                  {
                    "fixed": "0:1.36.2-11.el8_6.1"
                  },
                  {
                    "fixed": "0:1.36.2-11.el8_6.1"
                  },
                  {
                    "fixed": "0:1.36.2-14.el8_8.1"
                  },
                  {
                    "fixed": "0:1.36.2-14.el8_8.1"
                  },
                  {
                    "fixed": "0:1.48.1-8.el9_8.1"
                  },
                  {
                    "fixed": "0:1.48.1-4.el9_2.1"
                  },
                  {
                    "fixed": "0:1.48.1-4.el9_4.1"
                  },
                  {
                    "fixed": "0:1.48.1-6.el9_6.1"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "InverseAffectedRanges"
              }
            ]
          }
        ],
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84268.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-84268",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 520354,
  "published_at": "2026-09-01T15:15:23.685+00:00"
}