CVE-2026-84267: gvfs SFTP Information Disclosure Flaw

CVE-2026-84267 Overview

A flaw in the SFTP backend of GNOME Virtual File System (gvfs) allows a malicious SFTP server to read uninitialized heap memory from the gvfsd-sftp client process. The read_string() function allocates a buffer of a specified length but does not verify that the buffer is completely filled by server-supplied data. When the server returns a short FXP_HANDLE reply, the client treats the uninitialized bytes as part of the file handle and echoes them back to the server on subsequent operations. This information disclosure leaks the heap base and the load address of libgio, deterministically defeating Address Space Layout Randomization (ASLR) in the gvfsd-sftp process.

Critical Impact
A malicious SFTP server can deterministically defeat ASLR in gvfsd-sftp by exfiltrating uninitialized heap contents, providing a reliable primitive for chained exploitation.

Affected Products

GNOME gvfs (SFTP backend)
Linux distributions shipping gvfs (Red Hat advisory published)
Any desktop environment using gvfs to mount SFTP shares

Discovery Timeline

2026-09-01 - CVE-2026-84267 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84267

Vulnerability Analysis

The vulnerability is classified as Use of Uninitialized Resource [CWE-908]. It affects the SFTP protocol handling logic in the gvfs client daemon gvfsd-sftp. When mounting an SFTP share, the client parses server responses through read_string(), which allocates a heap buffer sized according to a length field supplied by the server. The function assumes the server sends exactly that many bytes of payload but omits a completeness check on the actual data read.

When a malicious server responds to an SSH_FXP_OPEN request with a truncated SSH_FXP_HANDLE message, only part of the allocated handle buffer is filled with attacker-controlled data. The remaining bytes retain whatever heap contents previously occupied that memory region. The client stores this partially uninitialized buffer as the opaque file handle and transmits it verbatim to the server in every subsequent request that references the handle.

Root Cause

The root cause is a missing length validation in read_string(). The function trusts the server-declared length field and returns a buffer without confirming that the read operation supplied the full payload. Combined with the SFTP protocol's use of opaque, client-echoed handles, this creates a reliable oracle for reading arbitrary heap contents.

Attack Vector

An attacker operates a malicious SFTP server and induces a victim to mount a share it controls, which requires user interaction. Once mounted, the attacker crafts a short FXP_HANDLE reply with a declared length of 128 bytes but supplies fewer bytes of actual handle data. The client returns the padded buffer on subsequent SFTP operations, leaking heap addresses back to the attacker. With the heap base and libgio load address disclosed, the attacker gains the address-space knowledge required to bypass ASLR for follow-on memory corruption exploits against gvfsd-sftp.

No verified public exploit code is currently available. See the GNOME gvfs Issue #861 and the Red Hat CVE-2026-84267 Advisory for upstream technical details.

Detection Methods for CVE-2026-84267

Indicators of Compromise

Outbound SFTP sessions from user workstations to untrusted or unexpected remote hosts.
gvfsd-sftp process activity correlated with mounts of non-corporate SFTP endpoints.
SFTP server logs showing malformed or truncated FXP_HANDLE responses being issued to clients.

Detection Strategies

Monitor GIO/GVFS mount events and correlate them with the destination host reputation for SFTP connections.
Inspect SFTP protocol traffic for FXP_HANDLE replies whose payload length is shorter than the declared string length field.
Alert on gvfsd-sftp connections to hosts outside a defined allowlist of internal file servers.

Monitoring Recommendations

Enable auditd rules for mount and gvfs-mount invocations referencing sftp:// URIs.
Capture process telemetry for gvfsd-sftp including remote peer address and process lineage.
Review network flow logs for outbound TCP/22 connections from endpoints that do not typically initiate SSH or SFTP sessions.

How to Mitigate CVE-2026-84267

Immediate Actions Required

Apply the gvfs security update from your Linux distribution as soon as it becomes available; track the Red Hat CVE-2026-84267 Advisory for package versions.
Instruct users to avoid mounting SFTP shares from untrusted or unknown servers until patches are deployed.
Enforce an allowlist of approved SFTP endpoints at the network layer for workstations.

Patch Information

Upstream tracking is available in GNOME gvfs Issue #861 and Red Hat Bug Report #2526466. The fix requires read_string() to validate that the buffer is fully populated by server-supplied bytes and to reject or zero-fill short responses before the data is used as an SFTP handle.

Workarounds

Disable or restrict use of the gvfs SFTP backend on multi-user or high-value hosts until the patch is applied.
Block outbound SFTP connections from endpoint subnets to arbitrary Internet destinations at the perimeter firewall.
Educate users that mounting SFTP shares requires user interaction and should only be performed against trusted infrastructure.

bash

# Example: restrict outbound SFTP to an approved server allowlist using nftables
nft add table inet sftp_filter
nft add chain inet sftp_filter output { type filter hook output priority 0 \; }
nft add rule inet sftp_filter output tcp dport 22 ip daddr { 10.10.0.10, 10.10.0.11 } accept
nft add rule inet sftp_filter output tcp dport 22 drop