CVE-2026-91786: Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size
A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory.
Other sources
A flaw was found in GNOME Shell's remote search integration. When rendering an icon supplied by a remote search provider over D-Bus, the icon's declared width, height, and row stride are passed to Shell.utilcreatepixbuffromdata() without validating that this geometry is consistent with the actual size of the supplied data buffer. A malicious or compromised search provider can advertise icon dimensions larger than its actual buffer, causing GNOME Shell to read past the end of the buffer when constructing the pixbuf for display. This out-of-bounds read can crash the GNOME Shell process, disrupting the user's session, and could potentially expose adjacent heap memory contents through the rendered icon.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running GNOME Shell are exposed when they process icons supplied by a remote search provider over D-Bus. The provider must be malicious or compromised to supply malformed icon metadata and buffer data.
What does exploitation require?
An attacker needs to cause GNOME Shell to render an icon from a remote search provider whose declared width, height, or row stride exceeds what the supplied icon-data buffer can support. The provided data indicates user interaction is required.
What is the likely impact if exploitation succeeds?
GNOME Shell may read beyond the icon-data buffer, which can crash the GNOME Shell process and disrupt the user's session. Adjacent heap memory could also be exposed through the rendered icon.