Executive brief
GNOME gvfs is a virtual filesystem library used by Linux desktop environments to mount remote shares including SFTP servers. A malicious SFTP server can trick the client into leaking sensitive heap memory containing encryption keys, library addresses, and other critical data. This defeats Address Space Layout Randomization (ASLR) security protections that systems rely on to prevent exploitation of other vulnerabilities.
Technical details
The vulnerability exists in the SFTP backend of gvfs, specifically in the read_string() function handling FXP_HANDLE replies. When a server sends a short reply, the function allocates a buffer to the requested size but fails to verify the buffer is completely filled, leaving uninitialized heap contents in the remainder. An attacker controlling a malicious SFTP server can exploit this by sending a crafted 128-byte FXP_HANDLE reply where most bytes are uninitialized heap memory. The client echoes these bytes back on all subsequent requests, allowing the attacker to read the gvfsd-sftp process heap memory and leak the heap base and libgio load address. This deterministic information disclosure defeats ASLR protections. The attack requires the victim to mount a share on the attacker-controlled SFTP server.
Affected products
- GNOME gvfs <unknown>
Timeline
- 2026-09-01: disclosed: CVE-2026-84267 published