CVE-2026-84268

Name	CVE-2026-84268
Description	A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
gvfs (PTS)	bookworm	1.50.3-1+deb12u1	vulnerable
	trixie	1.57.2-2+deb13u1	vulnerable
	forky, sid	1.60.0-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
gvfs	source	(unstable)	(unfixed)

Notes

https://gitlab.gnome.org/GNOME/gvfs/-/issues/862
Fixed by: https://gitlab.gnome.org/GNOME/gvfs/-/commit/5ab77256f9c071c7c99a5298db1729cf143bff05 (1.61.90)
Follow up: https://gitlab.gnome.org/GNOME/gvfs/-/commit/1ff24454d1c9b964a5f0efdd54c6d1421e770d64 (1.61.90)
Fixed by: https://gitlab.gnome.org/GNOME/gvfs/-/commit/ea1322daab1979b30cf96b3e39ed6db5e45fc041 (1.60.2)
Follow up: https://gitlab.gnome.org/GNOME/gvfs/-/commit/1590471ad9c382de4fc544bdf49c8f424eea96f8 (1.60.2)