CVE-2026-91786
Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size
A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size
A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory.
- Record
CVE-2026-91786- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-06
EUVDEUVD-2026-78417
A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory.
- Record
EUVD-2026-78417- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-f22f-r8xp-wr6f
A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus,...
A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory.
- Record
GHSA-f22f-r8xp-wr6f- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory.
- Record
CVE-2026-91786- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-06
OSVDEBIAN-CVE-2026-91786
A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory.
- Record
DEBIAN-CVE-2026-91786- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-06
OSVUBUNTU-CVE-2026-91786
A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory.
- Record
UBUNTU-CVE-2026-91786- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-03
Show 5 moreShow less
OSVopenSUSE-SU-2026:21976-1 No score
Security update for gnome-shell
This update for gnome-shell fixes the following issue:
- CVE-2026-91786: missing dimension validation when processing icons from a remote search provider via D-Bus can lead to an out-of-bounds read (bsc#1280619).
- Record
openSUSE-SU-2026:21976-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23950-1 No score
Security update for gnome-shell
This update for gnome-shell fixes the following issue:
- CVE-2026-91786: missing dimension validation when processing icons from a remote search provider via D-Bus can lead to an out-of-bounds read (bsc#1280619).
- Record
SUSE-SU-2026:23950-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4350-1 No score
Security update for gnome-shell
This update for gnome-shell fixes the following issue:
- CVE-2026-91786: missing dimension validation when processing icons from a remote search provider via D-Bus can lead to an out-of-bounds read (bsc#1280619).
- Record
SUSE-SU-2026:4350-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4373-1 No score
Security update for gnome-shell
This update for gnome-shell fixes the following issue:
- CVE-2026-91786: missing dimension validation when processing icons from a remote search provider via D-Bus can lead to an out-of-bounds read (bsc#1280619).
- Record
SUSE-SU-2026:4373-1- Updated
- 2026-11-02
OSVUSN-8971-1 No score
gnome-shell vulnerability
It was discovered that GNOME Shell did not properly validate icon dimensions when processing icons from a remote search provider. An attacker could possibly use this issue to cause GNOME Shell to crash, resulting in a denial of service, or expose sensitive information from memory.
- Record
USN-8971-1- Updated
- 2026-11-04
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gnome-shellDebian:12 |
All versions, plus listed versions 43.4-143.6-143.6-1~deb12u143.6-1~deb12u243.7-1 Show 45 moreShow less43.7-243.9-0+deb12u143.9-0+deb12u244.0-144.0-244.1-144.2-144.3-144.3-244.3-344.3-444.3-544.4-144.5-144.5-244.7-144.7-244.8-144.9-144.9-244~beta-144~rc-145.0-145.1-145.2-145.2-245.3-145.3-245~rc-146.0-146.0-246.1-146.2-146.3.1-146.3.1-246.3.1-346.3.1-446.4-147.0-147.0-247.0-347.1-147.1-247.2-147.2-2 |
None known |
gnome-shellDebian:13 |
All versions, plus listed versions 48.3-148.4-148.4-1~deb13u148.5-148.5-2 Show 25 moreShow less48.5-348.7-0+deb13u148.7-0+deb13u249.0-149.0-249.1-149.1-249.1-449.1-549.2-149.2-249.3-149.3-249.3-349.4-149.5-150.0-150.2-250.2-350.3-150.4-150.5-151.0-151.0-251.0-3 |
None known |
gnome-shellDebian:14 |
before 50.5-1, plus listed versions 48.3-148.4-148.4-1~deb13u148.5-148.5-2 Show 19 moreShow less48.5-349.0-149.0-249.1-149.1-249.1-449.1-549.2-149.2-249.3-149.3-249.3-349.4-149.5-150.0-150.2-250.2-350.3-150.4-1 |
50.5-1 |
gnome-shellSUSE:Linux Enterprise Server 16.0 |
before 48.4-160000.2.1 | 48.4-160000.2.1 |
gnome-shellSUSE:Linux Enterprise Server for SAP applications 16.0 |
before 48.4-160000.2.1 | 48.4-160000.2.1 |
gnome-shellSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 3.20.4-77.31.2 | 3.20.4-77.31.2 |
gnome-shellSUSE:Linux Enterprise Module for Desktop Applications 15 SP7 |
before 45.3-150700.11.6.1 | 45.3-150700.11.6.1 |
gnome-shellSUSE:Linux Enterprise Workstation Extension 15 SP7 |
before 45.3-150700.11.6.1 | 45.3-150700.11.6.1 |
gnome-shellUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.16.4-0ubuntu13.18.1-1ubuntu13.18.2-0ubuntu13.18.2-0ubuntu23.18.3-3ubuntu1 Show 7 moreShow less3.18.4-0ubuntu13.18.4-0ubuntu23.18.4-0ubuntu33.18.5-0ubuntu0.13.18.5-0ubuntu0.23.18.5-0ubuntu0.33.18.5-0ubuntu0.3+esm1 |
None known |
gnome-shellUbuntu:18.04:LTS |
All versions, plus listed versions 3.26.1-0ubuntu43.26.1-0ubuntu53.26.1-0ubuntu63.26.2-0ubuntu13.26.2-0ubuntu2 Show 20 moreShow less3.26.2-0ubuntu33.27.91-0ubuntu13.27.92-0ubuntu13.28.0-0ubuntu13.28.0-0ubuntu23.28.0-0ubuntu33.28.0-0ubuntu43.28.0-0ubuntu53.28.1-0ubuntu13.28.1-0ubuntu23.28.2-0ubuntu0.18.04.13.28.3-0ubuntu0.18.04.23.28.3-0ubuntu0.18.04.33.28.3-0ubuntu0.18.04.43.28.3+git20190124-0ubuntu18.04.13.28.3+git20190124-0ubuntu18.04.23.28.4-0ubuntu18.04.13.28.4-0ubuntu18.04.23.28.4-0ubuntu18.04.33.28.4-0ubuntu18.04.7 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gnome-shellUbuntu:20.04:LTS |
All versions, plus listed versions 3.34.1-1ubuntu13.34.1+git20191024-1ubuntu13.34.3-1ubuntu13.35.91-1ubuntu23.36.0-2ubuntu1 Show 14 moreShow less3.36.0-2ubuntu23.36.1-4ubuntu13.36.1-5ubuntu13.36.1-5ubuntu23.36.2-1ubuntu1~20.04.13.36.3-1ubuntu1~20.04.23.36.4-1ubuntu1~20.04.13.36.4-1ubuntu1~20.04.23.36.7-0ubuntu0.20.04.13.36.9-0ubuntu0.20.04.13.36.9-0ubuntu0.20.04.23.36.9-0ubuntu0.20.04.33.36.9-0ubuntu0.20.04.43.36.9-0ubuntu0.20.04.5 |
None known |
gnome-shellUbuntu:22.04:LTS |
before 42.9-0ubuntu2.4, plus listed versions 40.5-1ubuntu241.3-1ubuntu142~beta-1ubuntu242~beta-1ubuntu342.0-1ubuntu1 Show 9 moreShow less42.0-2ubuntu142.1-0ubuntu0.142.2-0ubuntu0.242.4-0ubuntu0.22.04.142.5-0ubuntu142.9-0ubuntu242.9-0ubuntu2.142.9-0ubuntu2.242.9-0ubuntu2.3 |
42.9-0ubuntu2.4 |
gnome-shellUbuntu:24.04:LTS |
before 46.0-0ubuntu6~24.04.17, plus listed versions 45.0-1ubuntu245.1-1ubuntu145.2-1ubuntu145.3-1ubuntu146.0-0ubuntu3.1 Show 16 moreShow less46.0-0ubuntu446.0-0ubuntu546.0-0ubuntu5.146.0-0ubuntu6~24.04.146.0-0ubuntu6~24.04.346.0-0ubuntu6~24.04.446.0-0ubuntu6~24.04.546.0-0ubuntu6~24.04.646.0-0ubuntu6~24.04.846.0-0ubuntu6~24.04.946.0-0ubuntu6~24.04.1146.0-0ubuntu6~24.04.1246.0-0ubuntu6~24.04.1346.0-0ubuntu6~24.04.1446.0-0ubuntu6~24.04.1546.0-0ubuntu6~24.04.16 |
46.0-0ubuntu6~24.04.17 |
gnome-shellUbuntu:26.04:LTS |
before 50.1-0ubuntu1.5, plus listed versions 49.0-1ubuntu149.1-5ubuntu149.2-1ubuntu149.2-1ubuntu250~beta-0ubuntu3 Show 9 moreShow less50.0-0ubuntu250.0-1ubuntu150.0-1ubuntu250.0-1ubuntu350.1-0ubuntu150.1-0ubuntu1.150.1-0ubuntu1.250.1-0ubuntu1.350.1-0ubuntu1.4 |
50.1-0ubuntu1.5 |
gnome-shellopenSUSE:Leap 16.0 |
before 48.4-160000.2.1 | 48.4-160000.2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | CVE List, EUVD, NVD, OSV | |
| affected, aliases | OSV | |
| affected, facts, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-91786 is a medium vulnerability (CVSS 6.1) in Red Hat Enterprise Linux 10, published September 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. Fixed in gnome-shell 50.5-1.
References
access.redhat.com/security/cve/CVE-2026-91786
bugzilla.redhat.com/show_bug.cgi?id=2533606
gitlab.gnome.org/GNOME/gnome-shell/-/issues/9365
nvd.nist.gov/vuln/detail/CVE-2026-91786
github.com/advisories/GHSA-f22f-r8xp-wr6f
security-tracker.debian.org/tracker/CVE-2026-91786
Show 10 moreShow less
suse.com/support/update/announcement/2026/suse-su-202623950-1
bugzilla.suse.com/1280619
ubuntu.com/security/CVE-2026-91786
cve.org/CVERecord?id=CVE-2026-91786
Left out here: 43 versions. The JSON record has them.