CVE-2026-84270: Gvfs: mtp: out-of-bounds read in do_read()
A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread() in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested, this unrestricted length is passed directly to memcpy(). This causes the operation to read memory outside the intended boundaries. This allows an attacker who plugs in a malicious MTP device to cause a segmentation fault when a file is read and crash the gvfsd-mtp process, resulting in a denial of service.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems that use the gvfs MTP backend and read files from a mounted MTP device are exposed. Exploitation requires a malicious physical MTP device to be plugged in and a file on that device to be read.
Does exploitation require authentication or user interaction?
No authentication is required. A user must interact with the malicious device by mounting it and reading a file from it.
What is the expected impact of a successful exploit?
A malicious device can cause gvfsd-mtp to crash through an out-of-bounds read, resulting in denial of service for the MTP backend process. The provided information does not describe confidentiality or integrity impact.
What can be done if patching is not immediately possible?
Avoid mounting or reading files from untrusted MTP devices. Restrict physical access to systems where feasible and use only trusted devices until an update is available.