CVE-2026-84267: Gvfs: sftp: uninitialized heap disclosure in read_string()
A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause readstring() to allocate a buffer with a certain length but the function does not verify that the buffer is completely filled, leaving the remainder of the buffer containing uninitialized heap contents. If the server sends a short FXPHANDLE reply, these uninitialized bytes are taken as the file handle. The client will then echo these uninitialized bytes back to the server on all subsequent requests using that handle. With a length of 128 bytes, this issue allows the malicious server to deterministically read uninitialized heap memory from the gvfsd-sftp process, leaking its heap base and the load address of the libgio library, resulting in a deterministic defeat of Address Space Layout Randomization (ASLR).
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems using the gvfs SFTP backend are exposed when a user mounts an SFTP share served by a malicious server. The issue affects the gvfsd-sftp client process rather than requiring compromise of the local SFTP server.
What does an attacker need to exploit it?
An attacker needs to operate or control an SFTP server and have a user mount a share from that server. No prior privileges are required, but user interaction is required.
What information can the malicious server obtain?
The server can cause the client to return uninitialized heap bytes as part of subsequent requests. With a 128-byte handle length, this can deterministically reveal the gvfsd-sftp heap base and the load address of libgio, defeating ASLR for that process.