CVE-2026-84269: Gvfs: afp: heap-based buffer overflow in dsi read path
A flaw was found in the AFP backend in gvfs. When mounting a share, a malicious AFP server can cause the DSI read path to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the pre-sized reply buffer, causing the operation to access past the intended boundaries. This issue allows a malicious server to overflow a heap buffer and crash the gvfsd-afp process, resulting in a denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gvfs (AFP backend)to a version that resolves this vulnerability.Fixed in 1.60.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the gvfs AFP backend are exposed when they mount an AFP share from a malicious server. The vulnerable process is gvfsd-afp.
What must an attacker do to trigger the flaw?
The attacker must provide a malicious AFP server and cause a user to mount a share from it. The attacker does not need privileges on the client, but user interaction is required.
What version fixes the issue?
The issue is fixed in gvfs version 1.60.2. The advisory states that all gvfs versions are affected.