gvfs AFP backend CVE-2026-84269

The victim must actively mount or browse an AFP share hosted by a malicious server - either by being social-engineered into connecting to a rogue address, or by an attacker performing DNS/DHCP spoofing to redirect a legitimate AFP hostname. The AFP backend (gvfs-backends) must be installed and the gvfsd-afp daemon must be running, which requires the AFP backend package to be present on the system. The flaw is triggered on the client side, so the attacker's only prerequisite is to control an AFP server that the victim connects to. Exploitation is limited by the UI:R requirement: automated, zero-interaction attacks against passive clients are not possible - a user action (mount, browse, or file manager navigation) is necessary. There is no authentication requirement on the attacker's side since they control the server. Impact is contained to the gvfsd-afp worker process crash; the host OS and other user sessions are unaffected.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) is well-calibrated for this issue. The network vector and low complexity reflect that a malicious server reachable over any network path can trigger the flaw. User interaction is required - a user must actively mount or connect to the rogue AFP share, which meaningfully limits opportunistic exploitation. Scope is unchanged, meaning the overflow is contained to the gvfsd-afp worker process; a crash does not escalate to host-level impact. There is no confirmed CISA KEV listing and no known public exploit code, making this a low-urgency issue for most environments. The absence of confidentiality and integrity impact confirms current understanding is DoS-only, though CWE-122 heap overflows carry a theoretical potential for code execution if memory layout conditions are favorable - however, the description characterizes the outcome as a crash, and no RCE has been reported. AFP connectivity is a non-default, deliberate configuration in RHEL environments; organizations not mounting AFP shares are not exposed. EPSS data was not provided; given no KEV and no POC, real-world exploitation probability is assessed as low.

An attacker operates a rogue AFP server on a network reachable by target users (e.g., a shared LAN, a VPN, or via DNS/DHCP poisoning to redirect legitimate AFP hostnames). A user on an RHEL system opens a file manager or runs a mount command pointing at the malicious server; the gvfsd-afp daemon connects and issues a read request. The server replies with a DSI length field larger than the client's buffer, triggering a heap overflow that crashes the gvfsd-afp process, denying the user filesystem access for that share. No public exploit code has been identified at time of analysis.