Description

A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-01T16:17:37.563Z",
  "pubdate": "2026-09-01T16:17:37.563Z",
  "executiveSummary": "A critical heap-based buffer overflow vulnerability exists within the SFTP backend of the gvfs component. This flaw arises from insufficient validation of server-provided data lengths during file read operations. By manipulating the SFTP protocol response, a malicious server can force the gvfsd-sftp process to write data beyond the bounds of an allocated memory buffer.\nThe vulnerability allows an attacker controlling a malicious SFTP server to trigger heap corruption within the client-side gvfsd-sftp process. Successful exploitation can lead to a denial-of-service condition due to process abortion, or potentially facilitate arbitrary code execution under the security context of the user running the gvfs mount.\nThe attack is triggered when a user attempts to mount or interact with a share hosted on a malicious SFTP server. The impact is significant as it affects the integrity and availability of the local client process, potentially compromising the host system if code execution is achieved. This vulnerability does not require authentication from the perspective of the server acting maliciously toward the client.",
  "technicalDetails": "The vulnerability resides within the read_reply() function of the gvfs SFTP backend implementation. During a file read operation, the gvfsd-sftp process issues a request to the SFTP server. Upon receiving a response, the backend is responsible for parsing the server's reply and copying the payload into an allocated memory buffer.\nThe root cause is a failure in the input validation logic within read_reply(). Specifically, the function processes a length field provided by the SFTP server without verifying if this length corresponds to the size of the buffer pre-allocated by the client. Because the implementation trusts the server-provided length, it performs a memory copy operation using an untrusted size parameter.\nThe exploitation flow proceeds as follows: First, an attacker establishes a malicious SFTP server environment. Second, the target user initiates a connection to this server using gvfs. Third, when a read operation is requested, the malicious server responds with a crafted packet where the declared data length exceeds the client's internal buffer capacity. Fourth, the read_reply() function proceeds to copy the excessive data into the heap, resulting in a buffer overflow that overwrites adjacent memory structures in the gvfsd-sftp heap space.\nThe overflow behavior typically leads to heap metadata corruption. When the memory allocator or internal heap consistency checks detect this corruption, the process terminates, resulting in a denial of service. If an attacker can precisely control the content of the heap by shaping allocations prior to the overflow, they may be able to overwrite function pointers or other critical structures to redirect process control flow, potentially leading to arbitrary code execution.\nThis vulnerability is restricted to the client-side gvfsd-sftp process and requires the user to interact with a malicious or compromised SFTP server. No specific authentication to the server is required for the malicious server to trigger the flaw once the connection is initiated. The scope of the impact is localized to the gvfsd-sftp process, but because this process operates within the user's session, any code execution would inherit the user's permissions."
}