Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-84268

Fixed in a distro release EPSS <1%CVSS 8.8

A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution.

Published 2026-09-01 · CVE record · OSV

Products: GNOME gvfs, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 6

Distro releases

ReleasePackageFixed in
AlmaLinux 10gvfs1.54.4-4.el10_2.1
AlmaLinux 10gvfs-client1.54.4-4.el10_2.1
AlmaLinux 10gvfs-fuse1.54.4-4.el10_2.1
AlmaLinux 10gvfs-goa1.54.4-4.el10_2.1
AlmaLinux 10gvfs-gphoto21.54.4-4.el10_2.1
AlmaLinux 10gvfs-mtp1.54.4-4.el10_2.1
AlmaLinux 10gvfs-smb1.54.4-4.el10_2.1
AlmaLinux 8gvfs1.36.2-22.el8_10
AlmaLinux 8gvfs-afc1.36.2-22.el8_10
AlmaLinux 8gvfs-afp1.36.2-22.el8_10
AlmaLinux 8gvfs-archive1.36.2-22.el8_10
AlmaLinux 8gvfs-client1.36.2-22.el8_10
AlmaLinux 8gvfs-devel1.36.2-22.el8_10
AlmaLinux 8gvfs-fuse1.36.2-22.el8_10
AlmaLinux 8gvfs-goa1.36.2-22.el8_10
AlmaLinux 8gvfs-gphoto21.36.2-22.el8_10
AlmaLinux 8gvfs-mtp1.36.2-22.el8_10
AlmaLinux 8gvfs-smb1.36.2-22.el8_10
AlmaLinux 9gvfs1.48.1-8.el9_8.1
AlmaLinux 9gvfs-client1.48.1-8.el9_8.1
AlmaLinux 9gvfs-devel1.48.1-8.el9_8.1
AlmaLinux 9gvfs-fuse1.48.1-8.el9_8.1
AlmaLinux 9gvfs-goa1.48.1-8.el9_8.1
AlmaLinux 9gvfs-gphoto21.48.1-8.el9_8.1
AlmaLinux 9gvfs-mtp1.48.1-8.el9_8.1
AlmaLinux 9gvfs-smb1.48.1-8.el9_8.1
Debian 12gvfsno fix
Debian 13gvfsno fix
Debian 14gvfs1.62.0-1
Red Hat Enterprise Linux 10.2gvfs0:1.54.4-4.el10_2.1
Red Hat Enterprise Linux 10.2gvfs-client0:1.54.4-4.el10_2.1
Red Hat Enterprise Linux 10.2gvfs-client-debuginfo0:1.54.4-4.el10_2.1
Red Hat Enterprise Linux 10.2gvfs-debuginfo0:1.54.4-4.el10_2.1
Red Hat Enterprise Linux 10.2gvfs-debugsource0:1.54.4-4.el10_2.1
Red Hat Enterprise Linux 10.2gvfs-fuse0:1.54.4-4.el10_2.1
Red Hat Enterprise Linux 10.2gvfs-fuse-debuginfo0:1.54.4-4.el10_2.1
Red Hat Enterprise Linux 10.2gvfs-goa0:1.54.4-4.el10_2.1
Red Hat Enterprise Linux 10.2gvfs-goa-debuginfo0:1.54.4-4.el10_2.1
Red Hat Enterprise Linux 10.2gvfs-gphoto20:1.54.4-4.el10_2.1
Red Hat Enterprise Linux 10.2gvfs-gphoto2-debuginfo0:1.54.4-4.el10_2.1
Red Hat Enterprise Linux 10.2gvfs-mtp0:1.54.4-4.el10_2.1
Red Hat Enterprise Linux 10.2gvfs-mtp-debuginfo0:1.54.4-4.el10_2.1
Red Hat Enterprise Linux 10.2gvfs-smb0:1.54.4-4.el10_2.1
Red Hat Enterprise Linux 10.2gvfs-smb-debuginfo0:1.54.4-4.el10_2.1
Red Hat Enterprise Linux 8gvfs0:1.36.2-22.el8_10
Red Hat Enterprise Linux 8gvfs-afc0:1.36.2-22.el8_10
Red Hat Enterprise Linux 8gvfs-afc-debuginfo0:1.36.2-22.el8_10
Red Hat Enterprise Linux 8gvfs-afp0:1.36.2-22.el8_10
Red Hat Enterprise Linux 8gvfs-afp-debuginfo0:1.36.2-22.el8_10
Red Hat Enterprise Linux 8gvfs-archive0:1.36.2-22.el8_10
Red Hat Enterprise Linux 8gvfs-archive-debuginfo0:1.36.2-22.el8_10
Red Hat Enterprise Linux 8gvfs-client0:1.36.2-22.el8_10
Red Hat Enterprise Linux 8gvfs-client-debuginfo0:1.36.2-22.el8_10
Red Hat Enterprise Linux 8gvfs-debuginfo0:1.36.2-22.el8_10
Red Hat Enterprise Linux 8gvfs-debugsource0:1.36.2-22.el8_10
Red Hat Enterprise Linux 8gvfs-devel0:1.36.2-22.el8_10
Red Hat Enterprise Linux 8gvfs-fuse0:1.36.2-22.el8_10
Red Hat Enterprise Linux 8gvfs-fuse-debuginfo0:1.36.2-22.el8_10
Red Hat Enterprise Linux 8gvfs-goa0:1.36.2-22.el8_10
Red Hat Enterprise Linux 8gvfs-goa-debuginfo0:1.36.2-22.el8_10
Red Hat Enterprise Linux 8gvfs-gphoto20:1.36.2-22.el8_10
Red Hat Enterprise Linux 8gvfs-gphoto2-debuginfo0:1.36.2-22.el8_10
Red Hat Enterprise Linux 8gvfs-mtp0:1.36.2-22.el8_10
Red Hat Enterprise Linux 8gvfs-mtp-debuginfo0:1.36.2-22.el8_10
Red Hat Enterprise Linux 8gvfs-smb0:1.36.2-22.el8_10
Red Hat Enterprise Linux 8gvfs-smb-debuginfo0:1.36.2-22.el8_10
Red Hat Enterprise Linux 9gvfs0:1.48.1-8.el9_8.1
Red Hat Enterprise Linux 9gvfs-client0:1.48.1-8.el9_8.1
Red Hat Enterprise Linux 9gvfs-client-debuginfo0:1.48.1-8.el9_8.1
Red Hat Enterprise Linux 9gvfs-debuginfo0:1.48.1-8.el9_8.1
Red Hat Enterprise Linux 9gvfs-debugsource0:1.48.1-8.el9_8.1
Red Hat Enterprise Linux 9gvfs-devel0:1.48.1-8.el9_8.1
Red Hat Enterprise Linux 9gvfs-fuse0:1.48.1-8.el9_8.1
Red Hat Enterprise Linux 9gvfs-fuse-debuginfo0:1.48.1-8.el9_8.1
Red Hat Enterprise Linux 9gvfs-goa0:1.48.1-8.el9_8.1
Red Hat Enterprise Linux 9gvfs-goa-debuginfo0:1.48.1-8.el9_8.1
Red Hat Enterprise Linux 9gvfs-gphoto20:1.48.1-8.el9_8.1
Red Hat Enterprise Linux 9gvfs-gphoto2-debuginfo0:1.48.1-8.el9_8.1
Red Hat Enterprise Linux 9gvfs-mtp0:1.48.1-8.el9_8.1
Red Hat Enterprise Linux 9gvfs-mtp-debuginfo0:1.48.1-8.el9_8.1
Red Hat Enterprise Linux 9gvfs-smb0:1.48.1-8.el9_8.1
Red Hat Enterprise Linux 9gvfs-smb-debuginfo0:1.48.1-8.el9_8.1
Rocky Linux 10gvfs0:1.54.4-4.el10_2.1
Rocky Linux 8gvfs0:1.36.2-22.el8_10
Rocky Linux 9gvfs0:1.48.1-8.el9_8.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSgvfs1.48.2-150400.4.15.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSgvfs1.48.2-150400.4.15.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSgvfs1.48.2-150400.4.15.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSSgvfs1.48.2-150400.4.15.1
SUSE Linux Enterprise Module for Desktop Applications 15 SP7gvfs1.52.2-150600.3.9.1
SUSE Linux Enterprise Server 12 SP5-LTSSgvfs1.28.3-18.12.1
SUSE Linux Enterprise Server 15 SP4-LTSSgvfs1.48.2-150400.4.15.1
SUSE Linux Enterprise Server 15 SP5-LTSSgvfs1.48.2-150400.4.15.1
SUSE Linux Enterprise Server 15 SP6-LTSSgvfs1.52.2-150600.3.9.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5gvfs1.28.3-18.12.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4gvfs1.48.2-150400.4.15.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5gvfs1.48.2-150400.4.15.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6gvfs1.52.2-150600.3.9.1
Ubuntu 22.04 LTSgvfs1.48.2-0ubuntu1.2
Ubuntu 24.04 LTSgvfs1.54.4-0ubuntu1~24.04.4
Ubuntu 26.04 LTSgvfs1.60.0-1ubuntu0.1
Ubuntu Pro 16.04 LTSgvfs1.28.2-1ubuntu1~16.04.3+esm1
Ubuntu Pro 18.04 LTSgvfs1.36.1-0ubuntu1.3.3+esm1
Ubuntu Pro 20.04 LTSgvfs1.44.1-1ubuntu1.2+esm1
openSUSE Leap 16.0gvfs1.59.90-160000.3.1
openSUSE Tumbleweedgvfs1.60.3-1.1