UBUNTU-CVE-2026-84270: Medium severity ubuntu/gvfs vulnerability
A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread() in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested, this unrestricted length is passed directly to memcpy(). This causes the operation to read memory outside the intended boundaries. This allows an attacker who plugs in a malicious MTP device to cause a segmentation fault when a file is read and crash the gvfsd-mtp process, resulting in a denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/gvfsto a version that resolves this vulnerability.Fixed in 1.48.2-0ubuntu1.3 - Upgrade
Upgrade
ubuntu/gvfsto a version that resolves this vulnerability.Fixed in 1.54.4-0ubuntu1~24.04.5 - Upgrade
Upgrade
ubuntu/gvfsto a version that resolves this vulnerability.Fixed in 1.60.0-1ubuntu0.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the gvfs MTP backend are exposed when a malicious MTP device is connected and a file on that device is read.
What does an attacker need to do to trigger the flaw?
The attacker needs to provide a malicious MTP device that returns more data than the client requested during a file-read operation. Exploitation also requires user interaction to connect the device and read a file from it.
What is the practical impact of successful exploitation?
The out-of-bounds read can cause a segmentation fault and crash the gvfsd-mtp process, resulting in denial of service. The provided information does not describe confidentiality or integrity impact.