CVE-2026-91786

Name	CVE-2026-91786
Description	A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
gnome-shell (PTS)	bookworm, bookworm (security)	43.9-0+deb12u2	vulnerable
	trixie	48.7-0+deb13u2	vulnerable
	forky, sid	50.4-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
gnome-shell	source	(unstable)	(unfixed)

Notes

https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/9365
https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/4418
Fixed by: https://gitlab.gnome.org/GNOME/gnome-shell/-/commit/8a3f208d0123b4831b1a4ba1040acc4f9091d465 (51.0)
https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/4417 (backports for 50.5)