Bug 2526485 (CVE-2026-84268) - CVE-2026-84268 gvfs: SFTP: heap-based buffer overflow in read_reply()
Summary: CVE-2026-84268 gvfs: SFTP: heap-based buffer overflow in read_reply()
Keywords:
Status: NEW
Alias: CVE-2026-84268
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2526944
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-31 19:51 UTC by OSIDB Bzimport
Modified: 2026-10-21 05:20 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:73997 0 None None None 2026-09-30 15:54:04 UTC
Red Hat Product Errata RHSA-2026:73998 0 None None None 2026-09-30 17:08:09 UTC
Red Hat Product Errata RHSA-2026:74370 0 None None None 2026-10-01 08:55:10 UTC
Red Hat Product Errata RHSA-2026:85939 0 None None None 2026-10-20 16:53:55 UTC
Red Hat Product Errata RHSA-2026:85940 0 None None None 2026-10-20 13:18:06 UTC
Red Hat Product Errata RHSA-2026:85941 0 None None None 2026-10-20 14:51:36 UTC
Red Hat Product Errata RHSA-2026:85942 0 None None None 2026-10-20 13:14:59 UTC
Red Hat Product Errata RHSA-2026:85943 0 None None None 2026-10-20 13:12:22 UTC
Red Hat Product Errata RHSA-2026:85944 0 None None None 2026-10-20 14:54:45 UTC
Red Hat Product Errata RHSA-2026:85945 0 None None None 2026-10-20 13:08:58 UTC
Red Hat Product Errata RHSA-2026:86606 0 None None None 2026-10-21 05:20:17 UTC

Description OSIDB Bzimport 2026-08-31 19:51:07 UTC 
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution. This vulnerability affects all gvfs versions and is fixed in version 1.60.2.
Comment 1 Jon Orris 2026-09-30 15:54:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:73997 https://access.redhat.com/errata/RHSA-2026:73997
Comment 2 Jon Orris 2026-09-30 17:08:09 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:73998 https://access.redhat.com/errata/RHSA-2026:73998
Comment 3 Jon Orris 2026-10-01 08:55:10 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:74370 https://access.redhat.com/errata/RHSA-2026:74370
Comment 4 Jon Orris 2026-10-20 13:08:58 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:85945 https://access.redhat.com/errata/RHSA-2026:85945
Comment 5 Jon Orris 2026-10-20 13:12:21 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:85943 https://access.redhat.com/errata/RHSA-2026:85943
Comment 6 Jon Orris 2026-10-20 13:14:58 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:85942 https://access.redhat.com/errata/RHSA-2026:85942
Comment 7 Jon Orris 2026-10-20 13:18:05 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:85940 https://access.redhat.com/errata/RHSA-2026:85940
Comment 8 Jon Orris 2026-10-20 14:51:35 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:85941 https://access.redhat.com/errata/RHSA-2026:85941
Comment 9 Jon Orris 2026-10-20 14:54:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:85944 https://access.redhat.com/errata/RHSA-2026:85944
Comment 10 Jon Orris 2026-10-20 16:53:54 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:85939 https://access.redhat.com/errata/RHSA-2026:85939
Comment 11 Jon Orris 2026-10-21 05:20:16 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:86606 https://access.redhat.com/errata/RHSA-2026:86606
Note You need to log in before you can comment on or make changes to this bug.