CVE-2026-84267 - Gvfs: sftp: uninitialized heap disclosure in read_string()
Brief
CVE ID : CVE-2026-84267
Published : Sept. 1, 2026, 4:17 p. m.
- 59 minutes ago
Description : A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause read_string() to allocate a buffer with a certain length but the function does not verify that the buffer is completely filled, leaving the remainder of the buffer containing uninitialized heap contents.
If the server sends a short FXP_HANDLE reply, these uninitialized bytes are taken as the file handle. The client will then echo these uninitialized bytes back to the server on all subsequent requests using that handle.