CVE-2026-91786
MediumCVSS 6.1Summary
A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory.
Risk Assessment
An attacker could remotely crash the user's graphical session and potentially leak data from GNOME Shell process memory. This impacts workstation availability and the confidentiality of data within the user's session.
Recommendation
Update GNOME Shell to a version containing the icon dimension validation fix and limit trust in remote search providers. Until patched, consider disabling or restricting remote search providers in the GNOME environment.
Other vulnerabilities in GNOME Shell
See all- CVE-2017-8288High
Versions of gnome-shell from 3.22 to 3.24.1 mishandle extensions that fail to reload, which can lead to leaving extensions enabled on the lock screen. This allows bystanders to launch applications and view information from those extensions.
- CVE-2014-7300High
GNOME Shell 3.14.x before 3.14.1 does not limit the aggregate memory consumption of active PrtSc requests, allowing nearby attackers to execute arbitrary commands on an unattended workstation.
Original NVD description (English source)
A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory.