CVE-2026-84268
Açıklama (NVD)
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution.
Yayın: 01.09.2026 · Son değişiklik: 05.11.2026 · Zayıflık: CWE-122
CVSS 3.1 metrikleri
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
| Saldırı vektörü | Ağ (uzaktan) |
| Karmaşıklık | Düşük |
| Gereken yetki | Yok |
| Kullanıcı etkileşimi | Gerekli |
| Kapsam | Değişmez |
| Gizlilik | Yüksek |
| Bütünlük | Yüksek |
| Erişilebilirlik | Yüksek |
Hesaplanan temel puan: 8.8. CVSS hesaplayıcıda incele
Referanslar
- https://access.redhat.com/errata/RHSA-2026:73997
- https://access.redhat.com/errata/RHSA-2026:73998
- https://access.redhat.com/errata/RHSA-2026:74370
- https://access.redhat.com/errata/RHSA-2026:85939
- https://access.redhat.com/errata/RHSA-2026:85940
- https://access.redhat.com/errata/RHSA-2026:85941
- https://access.redhat.com/errata/RHSA-2026:85942
- https://access.redhat.com/errata/RHSA-2026:85943
- https://access.redhat.com/errata/RHSA-2026:85944
- https://access.redhat.com/errata/RHSA-2026:85945
- https://access.redhat.com/errata/RHSA-2026:86606
- https://access.redhat.com/security/cve/CVE-2026-84268
- https://bugzilla.redhat.com/show_bug.cgi?id=2526485
- https://gitlab.gnome.org/GNOME/gvfs/-/issues/862