CVE-2026-84270Medium· 4.3▾ SunlitA flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, do_read() in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.1%
A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, do_read() in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested, this unrestricted length is passed directly to memcpy(). This causes the operation to read memory outside the intended boundaries. This allows an attacker who plugs in a malicious MTP device to cause a segmentation fault when a file is read and crash the gvfsd-mtp process, resulting in a denial of service.
gvfs < 1.60.2gvfs (all versions)gvfsgvfs (all versions)gvfs (all versions)gvfs (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
To mitigate this vulnerability, do not connect untrusted or unknown MTP devices to the system.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-80101Medium· 4.4Gimp: multiple heap out-of-bounds reads in xwd loader from unrelated width and bytes-per-line validation
CVE-2026-82328Medium· 6.1Gimp: heap out-of-bounds read in ico loader via unvalidated used_clrs palette count
CVE-2026-82324Medium· 6.1Gimp: heap out-of-bounds reads in iff/ilbm loader from ham row size mismatch and nplanes=0
CVE-2026-82330Medium· 6.1Gimp: heap out-of-bounds read in pvr vq (compressed) decoder due to missing bounds check
CVE-2026-84269Medium· 6.5Gvfs: afp: heap-based buffer overflow in dsi read path
CVE-2026-84267Medium· 4.3Gvfs: sftp: uninitialized heap disclosure in read_string()