Out-of-Bounds Read Vulnerability in GNOME Shell Affects System Stability
CVE-2026-91786

6.1MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Vendor
CVE Published:
15 September 2026

What is CVE-2026-91786?

A vulnerability exists in GNOME Shell due to inadequate validation of icon dimensions provided by remote search providers. When oversized dimensions are specified, the system may perform an out-of-bounds read, potentially leading to crashes in the GNOME Shell process. This flaw compromises user sessions and opens avenues for sensitive information to be exposed from adjacent memory locations, posing serious security risks.

References

https://access.redhat.com/security/cve/CVE-2026-91786
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2533606
issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/9365

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Mami for reporting this issue.
.