CVE-2026-84269

Name	CVE-2026-84269
Description	A flaw was found in the AFP backend in gvfs. When mounting a share, a malicious AFP server can cause the DSI read path to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the pre-sized reply buffer, causing the operation to access past the intended boundaries. This issue allows a malicious server to overflow a heap buffer and crash the gvfsd-afp process, resulting in a denial of service.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
gvfs (PTS)	bookworm	1.50.3-1+deb12u1	vulnerable
	trixie	1.57.2-2+deb13u1	vulnerable
	forky, sid	1.60.0-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
gvfs	source	(unstable)	(unfixed)

Notes

https://gitlab.gnome.org/GNOME/gvfs/-/issues/863
https://gitlab.gnome.org/GNOME/gvfs/-/merge_requests/340
Fixed by: https://gitlab.gnome.org/GNOME/gvfs/-/commit/072a7e02d11f5b7dfa324b70dd0e16d60f9b9e60 (1.61.90)
Fixed by: https://gitlab.gnome.org/GNOME/gvfs/-/commit/81525b2c917950554255784542674222bfee797d (1.60.2)