gvfs vulnerabilities

2 known vulnerabilities in gvfs from GNOME. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.0 High severity

  gvfs: Time-of-check Time-of-use (TOCTOU) Race Condition

  CVE-2026-88924Sep 10, 2026GNOME

  A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can

• 8.8 High severity

  gvfs: Heap-based Buffer Overflow

  CVE-2026-84268Sep 1, 2026GNOME

  A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length ag