SFTP Buffer Vulnerability in gvfs by GNOME

CVE-2026-84267

What is CVE-2026-84267?

A vulnerability exists in the SFTP backend of gvfs, where a malicious SFTP server can exploit the read_string() function. This flaw occurs during the mounting of a share, allowing the server to send a short FXP_HANDLE reply. Consequently, the read_string() function fails to verify that the allocated buffer is fully populated, which leads to the presence of uninitialized data in the buffer. When the client later communicates using the potentially compromised file handle, it unwittingly exposes uninitialized heap memory, inadvertently providing attackers with information about the heap base and memory addresses of critical components like the libgio library. This situation undermines the effectiveness of Address Space Layout Randomization (ASLR), potentially facilitating further exploitation.

References