CVE-2026-84268: Gvfs: sftp: heap-based buffer overflow in read_reply()
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users or systems that mount and read files from an SFTP share are exposed if the SFTP server is malicious. The vulnerable code runs in the gvfsd-sftp process.
What does an attacker need to exploit it?
An attacker needs to control, or cause a user to connect to, a malicious SFTP server. Exploitation occurs when the client mounts the share and reads a file; no attacker authentication is indicated, but user interaction is required.
What is the likely impact of a successful attack?
The malicious server can cause heap corruption in gvfsd-sftp. This can abort the process and cause denial of service, and may potentially permit arbitrary code execution.