Vulnerability-Lookup

USN-8845-1 (UBUNTU-CVE-2026-84268)

Vulnerability from osv_ubuntu – Published: 2026-09-30 15:54 – Updated: 2026-09-30 15:54 – Source website

Summary

gvfs vulnerabilities

Details

Keith Linneman discovered that GVfs did not properly validate data received from SFTP servers. An attacker could possibly use this issue to cause a heap buffer overflow, resulting in arbitrary code execution or a denial of service. (CVE-2026-84268)

It was discovered that GVfs incorrectly handled file ownership when creating private D-Bus sockets in the admin backend. A local attacker could possibly use this issue to change the ownership of arbitrary system files, resulting in privilege escalation to root. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-88924)

References

URL

Type

	https://ubuntu.com/security/notices/USN-8845-1	ADVISORY
	https://ubuntu.com/security/CVE-2026-84268	REPORT
	https://ubuntu.com/security/CVE-2026-88924	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2026-84268",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "gvfs",
            "binary_version": "1.28.2-1ubuntu1~16.04.3+esm1"
          },
          {
            "binary_name": "gvfs-backends",
            "binary_version": "1.28.2-1ubuntu1~16.04.3+esm1"
          },
          {
            "binary_name": "gvfs-bin",
            "binary_version": "1.28.2-1ubuntu1~16.04.3+esm1"
          },
          {
            "binary_name": "gvfs-common",
            "binary_version": "1.28.2-1ubuntu1~16.04.3+esm1"
          },
          {
            "binary_name": "gvfs-daemons",
            "binary_version": "1.28.2-1ubuntu1~16.04.3+esm1"
          },
          {
            "binary_name": "gvfs-fuse",
            "binary_version": "1.28.2-1ubuntu1~16.04.3+esm1"
          },
          {
            "binary_name": "gvfs-libs",
            "binary_version": "1.28.2-1ubuntu1~16.04.3+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "gvfs",
        "purl": "pkg:deb/ubuntu/gvfs@1.28.2-1ubuntu1~16.04.3+esm1?arch=source\u0026distro=esm-infra-legacy/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.28.2-1ubuntu1~16.04.3+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.24.2-0ubuntu4",
        "1.24.2-0ubuntu5",
        "1.24.2-0ubuntu6",
        "1.26.2-1ubuntu1",
        "1.27.3-1ubuntu1",
        "1.27.4-1ubuntu1",
        "1.27.90-1ubuntu1",
        "1.27.92-1ubuntu1",
        "1.28.1-1ubuntu1",
        "1.28.2-1ubuntu1~16.04.1",
        "1.28.2-1ubuntu1~16.04.2",
        "1.28.2-1ubuntu1~16.04.3"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2026-84268",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:18.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "gvfs",
            "binary_version": "1.36.1-0ubuntu1.3.3+esm1"
          },
          {
            "binary_name": "gvfs-backends",
            "binary_version": "1.36.1-0ubuntu1.3.3+esm1"
          },
          {
            "binary_name": "gvfs-bin",
            "binary_version": "1.36.1-0ubuntu1.3.3+esm1"
          },
          {
            "binary_name": "gvfs-common",
            "binary_version": "1.36.1-0ubuntu1.3.3+esm1"
          },
          {
            "binary_name": "gvfs-daemons",
            "binary_version": "1.36.1-0ubuntu1.3.3+esm1"
          },
          {
            "binary_name": "gvfs-fuse",
            "binary_version": "1.36.1-0ubuntu1.3.3+esm1"
          },
          {
            "binary_name": "gvfs-libs",
            "binary_version": "1.36.1-0ubuntu1.3.3+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "gvfs",
        "purl": "pkg:deb/ubuntu/gvfs@1.36.1-0ubuntu1.3.3+esm1?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.36.1-0ubuntu1.3.3+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.34.1-1ubuntu1",
        "1.34.1-1ubuntu3",
        "1.34.1-1ubuntu4",
        "1.34.1-2ubuntu2",
        "1.35.91-1ubuntu1",
        "1.35.91-1ubuntu2",
        "1.36.0-1ubuntu1",
        "1.36.1-0ubuntu1",
        "1.36.1-0ubuntu1.1",
        "1.36.1-0ubuntu1.2",
        "1.36.1-0ubuntu1.3",
        "1.36.1-0ubuntu1.3.2",
        "1.36.1-0ubuntu1.3.3"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2026-84268",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:20.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "gvfs",
            "binary_version": "1.44.1-1ubuntu1.2+esm1"
          },
          {
            "binary_name": "gvfs-backends",
            "binary_version": "1.44.1-1ubuntu1.2+esm1"
          },
          {
            "binary_name": "gvfs-bin",
            "binary_version": "1.44.1-1ubuntu1.2+esm1"
          },
          {
            "binary_name": "gvfs-common",
            "binary_version": "1.44.1-1ubuntu1.2+esm1"
          },
          {
            "binary_name": "gvfs-daemons",
            "binary_version": "1.44.1-1ubuntu1.2+esm1"
          },
          {
            "binary_name": "gvfs-fuse",
            "binary_version": "1.44.1-1ubuntu1.2+esm1"
          },
          {
            "binary_name": "gvfs-libs",
            "binary_version": "1.44.1-1ubuntu1.2+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "gvfs",
        "purl": "pkg:deb/ubuntu/gvfs@1.44.1-1ubuntu1.2+esm1?arch=source\u0026distro=esm-infra/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.44.1-1ubuntu1.2+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.42.1-1ubuntu1",
        "1.42.2-1ubuntu3",
        "1.43.90-1ubuntu3",
        "1.43.92-1ubuntu1",
        "1.44.0-1ubuntu1",
        "1.44.1-1ubuntu1",
        "1.44.1-1ubuntu1.1",
        "1.44.1-1ubuntu1.2"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2026-84268",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-88924",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gvfs",
            "binary_version": "1.48.2-0ubuntu1.2"
          },
          {
            "binary_name": "gvfs-backends",
            "binary_version": "1.48.2-0ubuntu1.2"
          },
          {
            "binary_name": "gvfs-common",
            "binary_version": "1.48.2-0ubuntu1.2"
          },
          {
            "binary_name": "gvfs-daemons",
            "binary_version": "1.48.2-0ubuntu1.2"
          },
          {
            "binary_name": "gvfs-fuse",
            "binary_version": "1.48.2-0ubuntu1.2"
          },
          {
            "binary_name": "gvfs-libs",
            "binary_version": "1.48.2-0ubuntu1.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "gvfs",
        "purl": "pkg:deb/ubuntu/gvfs@1.48.2-0ubuntu1.2?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.48.2-0ubuntu1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.47.91-1ubuntu1",
        "1.48.1-2ubuntu2",
        "1.48.1-2ubuntu3",
        "1.48.1-2ubuntu5",
        "1.48.1-3",
        "1.48.1-4",
        "1.48.2-0ubuntu1",
        "1.48.2-0ubuntu1.1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2026-84268",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-88924",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:24.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gvfs",
            "binary_version": "1.54.4-0ubuntu1~24.04.4"
          },
          {
            "binary_name": "gvfs-backends",
            "binary_version": "1.54.4-0ubuntu1~24.04.4"
          },
          {
            "binary_name": "gvfs-common",
            "binary_version": "1.54.4-0ubuntu1~24.04.4"
          },
          {
            "binary_name": "gvfs-daemons",
            "binary_version": "1.54.4-0ubuntu1~24.04.4"
          },
          {
            "binary_name": "gvfs-fuse",
            "binary_version": "1.54.4-0ubuntu1~24.04.4"
          },
          {
            "binary_name": "gvfs-libs",
            "binary_version": "1.54.4-0ubuntu1~24.04.4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "gvfs",
        "purl": "pkg:deb/ubuntu/gvfs@1.54.4-0ubuntu1~24.04.4?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.54.4-0ubuntu1~24.04.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.52.0-1",
        "1.52.1-1build1",
        "1.52.2-1",
        "1.53.90-2",
        "1.54.0-1build1",
        "1.54.0-1build2",
        "1.54.0-1build3",
        "1.54.0-1ubuntu2",
        "1.54.4-0ubuntu1~24.04.1",
        "1.54.4-0ubuntu1~24.04.2"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2026-84268",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-88924",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:26.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gvfs",
            "binary_version": "1.60.0-1ubuntu0.1"
          },
          {
            "binary_name": "gvfs-backends",
            "binary_version": "1.60.0-1ubuntu0.1"
          },
          {
            "binary_name": "gvfs-common",
            "binary_version": "1.60.0-1ubuntu0.1"
          },
          {
            "binary_name": "gvfs-daemons",
            "binary_version": "1.60.0-1ubuntu0.1"
          },
          {
            "binary_name": "gvfs-fuse",
            "binary_version": "1.60.0-1ubuntu0.1"
          },
          {
            "binary_name": "gvfs-libs",
            "binary_version": "1.60.0-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "gvfs",
        "purl": "pkg:deb/ubuntu/gvfs@1.60.0-1ubuntu0.1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.60.0-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.57.2-2ubuntu5",
        "1.57.2-2ubuntu6",
        "1.58.0-1ubuntu1",
        "1.58.0-2",
        "1.59.1-1",
        "1.59.90-3",
        "1.60.0-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Keith Linneman discovered that GVfs did not properly validate data\nreceived from SFTP servers. An attacker could possibly use this issue to\ncause a heap buffer overflow, resulting in arbitrary code execution or a\ndenial of service. (CVE-2026-84268)\n\nIt was discovered that GVfs incorrectly handled file ownership when\ncreating private D-Bus sockets in the admin backend. A local attacker\ncould possibly use this issue to change the ownership of arbitrary\nsystem files, resulting in privilege escalation to root. This issue only\naffected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.\n(CVE-2026-88924)",
  "id": "USN-8845-1",
  "modified": "2026-09-30T15:54:56Z",
  "published": "2026-09-30T15:54:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8845-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-84268"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-88924"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "gvfs vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2026-84268",
    "UBUNTU-CVE-2026-88924"
  ]
}

UBUNTU-CVE-2026-84268 (CVE-2026-84268)

Vulnerability from osv_ubuntu – Published: 2026-09-01 16:17 – Updated: 2026-10-01 03:32 – Source website

Details

A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution.

Severity

8.8 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-84268	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-84268	REPORT
	https://gitlab.gnome.org/GNOME/gvfs/-/issues/862	REPORT
	https://ubuntu.com/security/notices/USN-8845-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "gvfs",
            "binary_version": "1.28.2-1ubuntu1~16.04.3+esm1"
          },
          {
            "binary_name": "gvfs-backends",
            "binary_version": "1.28.2-1ubuntu1~16.04.3+esm1"
          },
          {
            "binary_name": "gvfs-bin",
            "binary_version": "1.28.2-1ubuntu1~16.04.3+esm1"
          },
          {
            "binary_name": "gvfs-common",
            "binary_version": "1.28.2-1ubuntu1~16.04.3+esm1"
          },
          {
            "binary_name": "gvfs-daemons",
            "binary_version": "1.28.2-1ubuntu1~16.04.3+esm1"
          },
          {
            "binary_name": "gvfs-fuse",
            "binary_version": "1.28.2-1ubuntu1~16.04.3+esm1"
          },
          {
            "binary_name": "gvfs-libs",
            "binary_version": "1.28.2-1ubuntu1~16.04.3+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "gvfs",
        "purl": "pkg:deb/ubuntu/gvfs@1.28.2-1ubuntu1~16.04.3+esm1?arch=source\u0026distro=esm-infra-legacy/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.28.2-1ubuntu1~16.04.3+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.24.2-0ubuntu4",
        "1.24.2-0ubuntu5",
        "1.24.2-0ubuntu6",
        "1.26.2-1ubuntu1",
        "1.27.3-1ubuntu1",
        "1.27.4-1ubuntu1",
        "1.27.90-1ubuntu1",
        "1.27.92-1ubuntu1",
        "1.28.1-1ubuntu1",
        "1.28.2-1ubuntu1~16.04.1",
        "1.28.2-1ubuntu1~16.04.2",
        "1.28.2-1ubuntu1~16.04.3"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "gvfs",
            "binary_version": "1.36.1-0ubuntu1.3.3+esm1"
          },
          {
            "binary_name": "gvfs-backends",
            "binary_version": "1.36.1-0ubuntu1.3.3+esm1"
          },
          {
            "binary_name": "gvfs-bin",
            "binary_version": "1.36.1-0ubuntu1.3.3+esm1"
          },
          {
            "binary_name": "gvfs-common",
            "binary_version": "1.36.1-0ubuntu1.3.3+esm1"
          },
          {
            "binary_name": "gvfs-daemons",
            "binary_version": "1.36.1-0ubuntu1.3.3+esm1"
          },
          {
            "binary_name": "gvfs-fuse",
            "binary_version": "1.36.1-0ubuntu1.3.3+esm1"
          },
          {
            "binary_name": "gvfs-libs",
            "binary_version": "1.36.1-0ubuntu1.3.3+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "gvfs",
        "purl": "pkg:deb/ubuntu/gvfs@1.36.1-0ubuntu1.3.3+esm1?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.36.1-0ubuntu1.3.3+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.34.1-1ubuntu1",
        "1.34.1-1ubuntu3",
        "1.34.1-1ubuntu4",
        "1.34.1-2ubuntu2",
        "1.35.91-1ubuntu1",
        "1.35.91-1ubuntu2",
        "1.36.0-1ubuntu1",
        "1.36.1-0ubuntu1",
        "1.36.1-0ubuntu1.1",
        "1.36.1-0ubuntu1.2",
        "1.36.1-0ubuntu1.3",
        "1.36.1-0ubuntu1.3.2",
        "1.36.1-0ubuntu1.3.3"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "gvfs",
            "binary_version": "1.44.1-1ubuntu1.2+esm1"
          },
          {
            "binary_name": "gvfs-backends",
            "binary_version": "1.44.1-1ubuntu1.2+esm1"
          },
          {
            "binary_name": "gvfs-bin",
            "binary_version": "1.44.1-1ubuntu1.2+esm1"
          },
          {
            "binary_name": "gvfs-common",
            "binary_version": "1.44.1-1ubuntu1.2+esm1"
          },
          {
            "binary_name": "gvfs-daemons",
            "binary_version": "1.44.1-1ubuntu1.2+esm1"
          },
          {
            "binary_name": "gvfs-fuse",
            "binary_version": "1.44.1-1ubuntu1.2+esm1"
          },
          {
            "binary_name": "gvfs-libs",
            "binary_version": "1.44.1-1ubuntu1.2+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "gvfs",
        "purl": "pkg:deb/ubuntu/gvfs@1.44.1-1ubuntu1.2+esm1?arch=source\u0026distro=esm-infra/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.44.1-1ubuntu1.2+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.42.1-1ubuntu1",
        "1.42.2-1ubuntu3",
        "1.43.90-1ubuntu3",
        "1.43.92-1ubuntu1",
        "1.44.0-1ubuntu1",
        "1.44.1-1ubuntu1",
        "1.44.1-1ubuntu1.1",
        "1.44.1-1ubuntu1.2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gvfs",
            "binary_version": "1.48.2-0ubuntu1.2"
          },
          {
            "binary_name": "gvfs-backends",
            "binary_version": "1.48.2-0ubuntu1.2"
          },
          {
            "binary_name": "gvfs-common",
            "binary_version": "1.48.2-0ubuntu1.2"
          },
          {
            "binary_name": "gvfs-daemons",
            "binary_version": "1.48.2-0ubuntu1.2"
          },
          {
            "binary_name": "gvfs-fuse",
            "binary_version": "1.48.2-0ubuntu1.2"
          },
          {
            "binary_name": "gvfs-libs",
            "binary_version": "1.48.2-0ubuntu1.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "gvfs",
        "purl": "pkg:deb/ubuntu/gvfs@1.48.2-0ubuntu1.2?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.48.2-0ubuntu1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.47.91-1ubuntu1",
        "1.48.1-2ubuntu2",
        "1.48.1-2ubuntu3",
        "1.48.1-2ubuntu5",
        "1.48.1-3",
        "1.48.1-4",
        "1.48.2-0ubuntu1",
        "1.48.2-0ubuntu1.1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gvfs",
            "binary_version": "1.54.4-0ubuntu1~24.04.4"
          },
          {
            "binary_name": "gvfs-backends",
            "binary_version": "1.54.4-0ubuntu1~24.04.4"
          },
          {
            "binary_name": "gvfs-common",
            "binary_version": "1.54.4-0ubuntu1~24.04.4"
          },
          {
            "binary_name": "gvfs-daemons",
            "binary_version": "1.54.4-0ubuntu1~24.04.4"
          },
          {
            "binary_name": "gvfs-fuse",
            "binary_version": "1.54.4-0ubuntu1~24.04.4"
          },
          {
            "binary_name": "gvfs-libs",
            "binary_version": "1.54.4-0ubuntu1~24.04.4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "gvfs",
        "purl": "pkg:deb/ubuntu/gvfs@1.54.4-0ubuntu1~24.04.4?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.54.4-0ubuntu1~24.04.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.52.0-1",
        "1.52.1-1build1",
        "1.52.2-1",
        "1.53.90-2",
        "1.54.0-1build1",
        "1.54.0-1build2",
        "1.54.0-1build3",
        "1.54.0-1ubuntu2",
        "1.54.4-0ubuntu1~24.04.1",
        "1.54.4-0ubuntu1~24.04.2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gvfs",
            "binary_version": "1.60.0-1ubuntu0.1"
          },
          {
            "binary_name": "gvfs-backends",
            "binary_version": "1.60.0-1ubuntu0.1"
          },
          {
            "binary_name": "gvfs-common",
            "binary_version": "1.60.0-1ubuntu0.1"
          },
          {
            "binary_name": "gvfs-daemons",
            "binary_version": "1.60.0-1ubuntu0.1"
          },
          {
            "binary_name": "gvfs-fuse",
            "binary_version": "1.60.0-1ubuntu0.1"
          },
          {
            "binary_name": "gvfs-libs",
            "binary_version": "1.60.0-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "gvfs",
        "purl": "pkg:deb/ubuntu/gvfs@1.60.0-1ubuntu0.1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.60.0-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.57.2-2ubuntu5",
        "1.57.2-2ubuntu6",
        "1.58.0-1ubuntu1",
        "1.58.0-2",
        "1.59.1-1",
        "1.59.90-3",
        "1.60.0-1"
      ]
    }
  ],
  "aliases": [],
  "details": "A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution.",
  "id": "UBUNTU-CVE-2026-84268",
  "modified": "2026-10-01T03:32:16Z",
  "published": "2026-09-01T16:17:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-84268"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84268"
    },
    {
      "type": "REPORT",
      "url": "https://gitlab.gnome.org/GNOME/gvfs/-/issues/862"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8845-1"
    }
  ],
  "related": [
    "USN-8845-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-84268"
  ]
}

UBUNTU-CVE-2026-88924 (CVE-2026-88924)

Vulnerability from osv_ubuntu – Published: 2026-09-10 15:17 – Updated: 2026-10-01 03:32 – Source website

Details

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.

Severity

7.0 (High)


                    
                      CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-88924	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-88924	REPORT
	https://gitlab.gnome.org/GNOME/gvfs/-/issues/875	REPORT
	https://gitlab.gnome.org/GNOME/gvfs/-/merge_reque…	REPORT
	https://ubuntu.com/security/notices/USN-8845-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gvfs",
            "binary_version": "1.48.2-0ubuntu1.2"
          },
          {
            "binary_name": "gvfs-backends",
            "binary_version": "1.48.2-0ubuntu1.2"
          },
          {
            "binary_name": "gvfs-common",
            "binary_version": "1.48.2-0ubuntu1.2"
          },
          {
            "binary_name": "gvfs-daemons",
            "binary_version": "1.48.2-0ubuntu1.2"
          },
          {
            "binary_name": "gvfs-fuse",
            "binary_version": "1.48.2-0ubuntu1.2"
          },
          {
            "binary_name": "gvfs-libs",
            "binary_version": "1.48.2-0ubuntu1.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "gvfs",
        "purl": "pkg:deb/ubuntu/gvfs@1.48.2-0ubuntu1.2?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.48.2-0ubuntu1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.47.91-1ubuntu1",
        "1.48.1-2ubuntu2",
        "1.48.1-2ubuntu3",
        "1.48.1-2ubuntu5",
        "1.48.1-3",
        "1.48.1-4",
        "1.48.2-0ubuntu1",
        "1.48.2-0ubuntu1.1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gvfs",
            "binary_version": "1.54.4-0ubuntu1~24.04.4"
          },
          {
            "binary_name": "gvfs-backends",
            "binary_version": "1.54.4-0ubuntu1~24.04.4"
          },
          {
            "binary_name": "gvfs-common",
            "binary_version": "1.54.4-0ubuntu1~24.04.4"
          },
          {
            "binary_name": "gvfs-daemons",
            "binary_version": "1.54.4-0ubuntu1~24.04.4"
          },
          {
            "binary_name": "gvfs-fuse",
            "binary_version": "1.54.4-0ubuntu1~24.04.4"
          },
          {
            "binary_name": "gvfs-libs",
            "binary_version": "1.54.4-0ubuntu1~24.04.4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "gvfs",
        "purl": "pkg:deb/ubuntu/gvfs@1.54.4-0ubuntu1~24.04.4?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.54.4-0ubuntu1~24.04.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.52.0-1",
        "1.52.1-1build1",
        "1.52.2-1",
        "1.53.90-2",
        "1.54.0-1build1",
        "1.54.0-1build2",
        "1.54.0-1build3",
        "1.54.0-1ubuntu2",
        "1.54.4-0ubuntu1~24.04.1",
        "1.54.4-0ubuntu1~24.04.2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gvfs",
            "binary_version": "1.60.0-1ubuntu0.1"
          },
          {
            "binary_name": "gvfs-backends",
            "binary_version": "1.60.0-1ubuntu0.1"
          },
          {
            "binary_name": "gvfs-common",
            "binary_version": "1.60.0-1ubuntu0.1"
          },
          {
            "binary_name": "gvfs-daemons",
            "binary_version": "1.60.0-1ubuntu0.1"
          },
          {
            "binary_name": "gvfs-fuse",
            "binary_version": "1.60.0-1ubuntu0.1"
          },
          {
            "binary_name": "gvfs-libs",
            "binary_version": "1.60.0-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "gvfs",
        "purl": "pkg:deb/ubuntu/gvfs@1.60.0-1ubuntu0.1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.60.0-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.57.2-2ubuntu5",
        "1.57.2-2ubuntu6",
        "1.58.0-1ubuntu1",
        "1.58.0-2",
        "1.59.1-1",
        "1.59.90-3",
        "1.60.0-1"
      ]
    }
  ],
  "aliases": [],
  "details": "A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker\u0027s user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.",
  "id": "UBUNTU-CVE-2026-88924",
  "modified": "2026-10-01T03:32:18Z",
  "published": "2026-09-10T15:17:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-88924"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-88924"
    },
    {
      "type": "REPORT",
      "url": "https://gitlab.gnome.org/GNOME/gvfs/-/issues/875"
    },
    {
      "type": "REPORT",
      "url": "https://gitlab.gnome.org/GNOME/gvfs/-/merge_requests/352"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8845-1"
    }
  ],
  "related": [
    "USN-8845-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-88924"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

USN-8845-1 (UBUNTU-CVE-2026-84268)

UBUNTU-CVE-2026-84268 (CVE-2026-84268)

UBUNTU-CVE-2026-88924 (CVE-2026-88924)

Tags

Sightings

Nomenclature

Related by attack behaviour