UBUNTU-CVE-2026-84269: Medium severity ubuntu/gvfs vulnerability

Q: Who is exposed to this issue?

Systems running Ubuntu's gvfs AFP backend are exposed when a user mounts an AFP share served by an attacker-controlled or malicious AFP server. The impact described is a crash of the gvfsd-afp process.

Q: What does an attacker need to exploit it?

An attacker needs to operate or control an AFP server that a user mounts. Exploitation requires user interaction because the malicious share must be mounted.

Q: What is the practical impact of a successful exploit?

A malicious server can trigger a heap-buffer overflow condition in gvfsd-afp and cause that process to crash, resulting in denial of service. The provided data does not describe confidentiality or integrity impact.

Q: What can be done if patching is not immediately possible?

Avoid mounting AFP shares from untrusted or unknown servers. Restrict AFP share mounting to trusted servers until an update is available.

Published Sep 1, 2026

Updated

A flaw was found in the AFP backend in gvfs. When mounting a share, a malicious AFP server can cause the DSI read path to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the pre-sized reply buffer, causing the operation to access past the intended boundaries. This issue allows a malicious server to overflow a heap buffer and crash the gvfsd-afp process, resulting in a denial of service.

Affected Software

6 affected componentsFixes available

ubuntu/gvfs*

ubuntu/gvfs<1.48.2-0ubuntu1.3

1.48.2-0ubuntu1.3

ubuntu/gvfs<1.54.4-0ubuntu1~24.04.5

1.54.4-0ubuntu1~24.04.5

ubuntu/gvfs<1.60.0-1ubuntu0.2

1.60.0-1ubuntu0.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/gvfs to a version that resolves this vulnerability.
Fixed in 1.48.2-0ubuntu1.3
Upgrade
Upgrade ubuntu/gvfs to a version that resolves this vulnerability.
Fixed in 1.54.4-0ubuntu1~24.04.5
Upgrade
Upgrade ubuntu/gvfs to a version that resolves this vulnerability.
Fixed in 1.60.0-1ubuntu0.2

Event History

Sep 1, 2026

CVE Published

via OSV·04:17 PM

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Systems running Ubuntu's gvfs AFP backend are exposed when a user mounts an AFP share served by an attacker-controlled or malicious AFP server. The impact described is a crash of the gvfsd-afp process.

What does an attacker need to exploit it?

An attacker needs to operate or control an AFP server that a user mounts. Exploitation requires user interaction because the malicious share must be mounted.

What is the practical impact of a successful exploit?

A malicious server can trigger a heap-buffer overflow condition in gvfsd-afp and cause that process to crash, resulting in denial of service. The provided data does not describe confidentiality or integrity impact.

What can be done if patching is not immediately possible?

Avoid mounting AFP shares from untrusted or unknown servers. Restrict AFP share mounting to trusted servers until an update is available.

UBUNTU-CVE-2026-84269: Medium severity ubuntu/gvfs vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the practical impact of a successful exploit?

What can be done if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the practical impact of a successful exploit?

What can be done if patching is not immediately possible?