Gvfs

This hub aggregates every CVE we track for Gvfs, a product in the consumer software space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 10 most recently published vulnerabilities affecting Gvfs.

• CVE-2026-88924Gvfs: gvfs-admin socket ownership race permits local root7.0Sep 10, 2026
• CVE-2026-84270Gvfs: mtp: out-of-bounds read in do_read()4.3Sep 1, 2026
• CVE-2026-84269Gvfs: afp: heap-based buffer overflow in dsi read path6.5Sep 1, 2026
• CVE-2026-84267Gvfs: sftp: uninitialized heap disclosure in read_string()4.3Sep 1, 2026
• CVE-2026-84268Gvfs: sftp: heap-based buffer overflow in read_reply()8.8Sep 1, 2026
• CVE-2019-12795daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket without configuring an authorization rule. A local at...7.8Jun 11, 2019
• CVE-2019-12449An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles a file's user and group ownership during move (and copy with G_FILE_COPY_ALL_METADATA) operations f...5.7May 29, 2019
• CVE-2019-12448An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c has race conditions because the admin backend doesn't implement query_info_on_read/write.8.1May 29, 2019
• CVE-2019-12447An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid is not used.7.3May 29, 2019
• CVE-2019-3827An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modify arbitrary files by privileged users without asking for password when no aut...7.0Mar 25, 2019