CVE-2026-91786: GNOME Shell DOS Vulnerability via Icon Processing

CVE-2026-91786 Overview

CVE-2026-91786 is an out-of-bounds read vulnerability in GNOME Shell that occurs when the desktop environment processes icons received from remote search providers over D-Bus. GNOME Shell fails to validate an icon's declared dimensions against the actual data buffer size before accessing memory. A malicious or compromised remote search provider can supply oversized icon dimensions to trigger reads beyond allocated memory. Exploitation causes the GNOME Shell process to crash, terminating the user's active session. Adjacent memory may also be disclosed, potentially leaking sensitive process data. The flaw is tracked under CWE-125: Out-of-bounds Read.

Critical Impact
A rogue D-Bus search provider can crash the user's GNOME Shell session and potentially disclose adjacent process memory containing sensitive data.

Affected Products

GNOME Shell (versions processing remote search provider icons via D-Bus)
Linux distributions shipping affected GNOME Shell packages, including Red Hat Enterprise Linux (see the Red Hat CVE Overview)
Desktop environments relying on GNOME Shell remote search integration

Discovery Timeline

2026-09-15 - CVE-2026-91786 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91786

Vulnerability Analysis

GNOME Shell integrates with remote search providers through D-Bus, allowing third-party applications to contribute results to the shell's search overview. Search results commonly include icon data supplied by the provider. When GNOME Shell decodes these icons, it trusts the width and height values declared by the caller. The code path does not cross-check those dimensions against the size of the accompanying pixel buffer. An attacker who controls a search provider can advertise dimensions larger than the underlying buffer. The rendering routine then walks past the end of the buffer, reading unrelated process memory.

The immediate consequence is a crash of the GNOME Shell process, which ends the user's graphical session and any unsaved work. Because the out-of-bounds read touches memory adjacent to the icon buffer, the leaked bytes may contain sensitive material processed by the shell, such as clipboard contents, notification text, or fragments of credentials.

Root Cause

The root cause is missing input validation on attacker-influenced data received over D-Bus. GNOME Shell uses the declared icon dimensions as loop bounds when accessing the pixel buffer, without verifying that width * height * bytes_per_pixel fits within the buffer length reported by the D-Bus message. This is a classic CWE-125 pattern where declared metadata is trusted over the actual payload size.

Attack Vector

Exploitation requires a malicious or compromised remote search provider to be installed and enabled on the target user's system, and requires user interaction to trigger a search that returns the crafted result. The attack executes in the local user context. A supply chain compromise of a legitimate search provider, or social engineering to install a rogue one, are the primary delivery paths. See the GNOME Shell issue discussion for additional context.

No verified public exploit code is available. Refer to the Red Hat Bug Report for further technical details.

Detection Methods for CVE-2026-91786

Indicators of Compromise

Unexpected crashes or restarts of the gnome-shell process recorded in journalctl or coredumpctl output.
Presence of unknown .desktop search provider definitions under /usr/share/gnome-shell/search-providers/ or ~/.local/share/gnome-shell/search-providers/.
D-Bus service registrations for search providers that do not correspond to installed, trusted applications.

Detection Strategies

Monitor system journals for repeated gnome-shell segmentation faults correlated with search activity.
Inventory installed GNOME Shell search providers and compare against an approved baseline on managed Linux endpoints.
Alert on new files written to search provider directories outside of package manager transactions.

Monitoring Recommendations

Forward systemd-coredump and journald events from Linux workstations to a central log platform for correlation.
Track D-Bus service name registrations that implement the org.gnome.Shell.SearchProvider2 interface.
Review Linux endpoint telemetry for unsigned or unexpected user-installed GNOME Shell extensions and providers.

How to Mitigate CVE-2026-91786

Immediate Actions Required

Apply the GNOME Shell security update from your Linux distribution as soon as it is available; track status via the Red Hat CVE Overview.
Audit installed search providers on all Linux endpoints and remove any that are not required or not from a trusted source.
Restrict installation of third-party GNOME Shell extensions and search providers on managed systems.

Patch Information

Refer to the distribution advisories for fixed package versions. Red Hat customers should consult the Red Hat CVE Overview and the associated Red Hat Bug Report. Upstream fix discussion is tracked in the GNOME Shell issue. Apply the update and restart the user session so the patched gnome-shell binary is loaded.

Workarounds

Disable remote search providers by clearing the enabled providers list in GNOME Settings under Search until the patch is applied.
Remove untrusted search provider definitions from /usr/share/gnome-shell/search-providers/ and per-user equivalents.
Limit exposure by running affected Linux desktops under standard user accounts and avoiding installation of unvetted software that ships D-Bus search providers.

bash

# Disable all GNOME Shell remote search providers for the current user
gsettings set org.gnome.desktop.search-providers disabled \
  "$(gsettings get org.gnome.desktop.search-providers enabled)"
gsettings set org.gnome.desktop.search-providers enabled "[]"

# List currently installed search provider definitions to review
ls -l /usr/share/gnome-shell/search-providers/ \
      ~/.local/share/gnome-shell/search-providers/ 2>/dev/null