gvfs CVE-2026-84267

Exploitation requires the target user to actively initiate an SFTP mount to an attacker-controlled server - for example, by clicking a crafted sftp:// link, using Nautilus 'Connect to Server', or running gio mount against the malicious host. The gvfsd-sftp daemon must be installed and invocable, which is standard on GNOME desktop environments but typically absent on headless RHEL servers. No client-side privileges or authentication are required beyond the user-initiated mount action. The vulnerability is limited to GNOME/gvfs desktop installations; server deployments without a graphical session, or environments where outbound SFTP is restricted to approved hosts, are not exposed. The flaw produces information disclosure only - it does not grant code execution independently and must be chained with a separate memory-corruption primitive to become directly dangerous.

The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) correctly captures the information-disclosure-only nature of the flaw and the required user interaction, but the C:L rating understates the strategic value of what is actually leaked. A deterministic ASLR defeat - yielding both the heap base and the libgio load address - is a standard first stage in modern exploit chains; paired with any unpatched memory-corruption bug in gvfsd-sftp or libgio, this infoleak transforms a theoretical flaw into a practical code-execution primitive. Attack complexity is genuinely low once the user connects, because the leak is reliable and repeatable per the description. No EPSS data was supplied; exploitation probability is assessed as low in the near term given the absence of KEV listing and no known POC. The UI:R constraint meaningfully limits opportunistic mass exploitation but does not protect against targeted campaigns using phishing or malicious URI handlers. Defenders should treat this as a medium-priority patch with elevated concern in environments where gvfsd-sftp users may also be exposed to other memory-safety bugs in the GNOME stack.

An attacker stands up a rogue SFTP server and lures a GNOME desktop user into mounting it - via a phishing email containing an sftp:// URI, a malicious bookmark, or a social-engineering prompt to use Nautilus 'Connect to Server'. The server sends a crafted FXP_HANDLE reply declared as 128 bytes but containing only a short payload; gvfsd-sftp fills the remainder of the handle buffer from adjacent uninitialized heap memory. On the client's next FXP_READ or FXP_CLOSE, those raw heap bytes are echoed back, and the attacker reads them to extract the heap base and libgio ASLR offset for use in a subsequent memory-corruption exploit. No public exploit code is known to exist at this time.