CVE-2026-84269 in Red Hat
Summary
by MITRE • 09/01/2026
A flaw was found in the AFP backend in gvfs. When mounting a share, a malicious AFP server can cause the DSI read path to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the pre-sized reply buffer, causing the operation to access past the intended boundaries. This issue allows a malicious server to overflow a heap buffer and crash the gvfsd-afp process, resulting in a denial of service.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified within the AFP backend of GVFS represents a critical memory safety flaw rooted in improper input validation during network communication protocols. Specifically, this issue resides in the Data Stream Interface read path when handling connections to Apple Filing Protocol servers. The core technical defect involves a failure by the application logic to verify that the length value provided by the server matches or remains within the bounds of the pre-allocated reply buffer. In standard secure coding practices, any data size received from an external source must be rigorously validated against the capacity of the destination memory structure before copying operations occur. Here, the gvfsd-afp process blindly trusts the length field sent by the remote AFP server without performing a comparative check against the actual allocated heap buffer size. This lack of boundary checking creates a direct pathway for a heap-based buffer overflow condition to be triggered during normal file system mounting and data retrieval operations.
From an operational perspective, this vulnerability allows a malicious actor operating a rogue or compromised AFP server to exploit the trust relationship established by the client machine. By crafting a specially crafted response that specifies a length value significantly larger than the allocated buffer size, the attacker forces the gvfsd-afp process to write data beyond its intended memory boundaries. The immediate consequence of this out-of-bounds write is the corruption of adjacent heap metadata or application state variables, which typically leads to an instantaneous crash of the gvfsd-afp daemon. This results in a denial of service for any user attempting to access AFP shares through GVFS on affected systems. While the primary impact observed is stability degradation and process termination, buffer overflows inherently carry the risk of arbitrary code execution if the attacker can precisely control the overwritten memory regions to manipulate return addresses or function pointers, although the current description emphasizes the denial of service aspect due to the crash behavior.
This vulnerability aligns with Common Weakness Enumeration CWE-120, which classifies Buffer Copy without Checking Size of Input Classic Buffer Overflow, as well as CWE-787, Out-of-bounds Write. The attack vector leverages network interaction and is categorized under MITRE ATT&CK technique T1496, Resource Hijacking via Denial of Service, specifically targeting the availability component of the CIA triad by exhausting system resources through repeated crashes or forcing service restarts that disrupt user productivity. To mitigate this risk, users should ensure their systems are updated with patches released by distribution maintainers that address the validation logic in the gvfs AFP backend. Administrators can also reduce exposure by restricting access to untrusted AFP servers and implementing network segmentation policies that limit direct connectivity between client workstations and potentially hostile file sharing infrastructure until the underlying code defect is resolved through rigorous input sanitization and bounds checking implementation.