Buffer Overflow Vulnerability in GVFS MTP Backend by GNOME
CVE-2026-84270
4.3MEDIUM
What is CVE-2026-84270?
A vulnerability has been identified in the MTP backend of GVFS where the do_read() function improperly trusts the data length returned by an MTP device. When reading files, if a malicious MTP device sends more bytes than what was originally requested, this leads to unbounded data being passed to the memcpy() function. Consequently, this flaw enables an attacker to cause a buffer overflow, resulting in a segmentation fault and crashing the gvfsd-mtp process, which effectively leads to a denial of service.
References
CVSS V3.1
Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Red Hat would like to thank Keith Linneman (LinnemanLabs) for reporting this issue.