---
id: CVE-2026-84270
title: 'Gvfs: mtp: out-of-bounds read in do_read()'
summary: >-
  A flaw was found in the MTP backend in gvfs. When reading a file from a
  mounted MTP device, do_read() in gvfsbackendmtp.c trusts the data length
  returned by the device without limiting it to the original size requested by
  the client. If …
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-125
vendor: GNOME
product: gvfs
affected:
  - gvfs < 1.60.2
  - gvfs (all versions)
  - gvfs
  - gvfs (all versions)
  - gvfs (all versions)
  - gvfs (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-01T17:24:44.003333Z'
published: '2026-09-01'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T01:05:54.990Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-84270'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-84270'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2526794'
    label: RHBZ#2526794
  - url: 'https://gitlab.gnome.org/GNOME/gvfs/-/issues/864'
tags:
  - cve.org
epss: 0.0015
epssPercentile: 0.042
ingestedAt: '2026-11-06T01:43:15.121Z'
---

## Overview

A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, do_read() in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested, this unrestricted length is passed directly to memcpy(). This causes the operation to read memory outside the intended boundaries. This allows an attacker who plugs in a malicious MTP device to cause a segmentation fault when a file is read and crash the gvfsd-mtp process, resulting in a denial of service.

## Affected

- `gvfs < 1.60.2`
- `gvfs (all versions)`
- `gvfs`
- `gvfs (all versions)`
- `gvfs (all versions)`
- `gvfs (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

To mitigate this vulnerability, do not connect untrusted or unknown MTP devices to the system.