Executive brief
GNOME gvfs is a virtual filesystem implementation that handles mounting remote file shares. A malicious AFP (Apple Filing Protocol) server can trigger a heap buffer overflow in the gvfsd-afp daemon when a client mounts a share, causing the service to crash and making the client unable to access their remote files (denial of service).
Technical details
The vulnerability is a heap buffer overflow in the AFP backend's DSI (Data Stream Interface) read path. When processing a server response during share mounting, the code fails to validate that the length field provided by a malicious AFP server stays within the bounds of the pre-allocated reply buffer. An attacker running a malicious AFP server can craft a response with an oversized length value, causing the read operation to access memory past the intended buffer boundaries. This results in heap corruption and crashes the gvfsd-afp process. The attack requires that a client initiates a connection to the attacker-controlled server; no authentication bypass or prior local access is necessary.
Affected products
- GNOME gvfs <UNKNOWN>
Timeline
- 2026-09-01: disclosed