{"id":"CVE-2026-91786","aliases":["DEBIAN-CVE-2026-91786","EUVD-2026-78417","GHSA-f22f-r8xp-wr6f","OESA-2026-4854","OESA-2026-4855","OESA-2026-4856","OESA-2026-4857","SUSE-SU-2026:23950-1","SUSE-SU-2026:4350-1","SUSE-SU-2026:4373-1","UBUNTU-CVE-2026-91786","USN-8971-1","openSUSE-SU-2026:21976-1"],"status":"published","title":"Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size","description":"A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00131,"percentile":0.02762,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-09-15T11:00:53Z","modified":"2026-11-11T12:45:12Z","fixes":[{"ecosystem":"Debian:14","package":"gnome-shell","fixed_in":["50.5-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"gnome-shell","fixed_in":["44.6-4.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"gnome-shell","fixed_in":["44.6-4.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"gnome-shell","fixed_in":["3.38.4-5.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"gnome-shell","fixed_in":["44.6-4.oe2403sp1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"gnome-shell","fixed_in":["48.4-160000.2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"gnome-shell","fixed_in":["48.4-160000.2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"gnome-shell","fixed_in":["3.20.4-77.31.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"gnome-shell","fixed_in":["45.3-150700.11.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"gnome-shell","fixed_in":["45.3-150700.11.6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"gnome-shell","fixed_in":["42.9-0ubuntu2.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"gnome-shell","fixed_in":["46.0-0ubuntu6~24.04.17"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"gnome-shell","fixed_in":["50.1-0ubuntu1.5"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"gnome-shell","fixed_in":["48.4-160000.2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["43.4-1","43.6-1","43.6-1~deb12u1","43.6-1~deb12u2","43.7-1","43.7-2","43.9-0+deb12u1","43.9-0+deb12u2","44.0-1","44.0-2","44.1-1","44.2-1","44.3-1","44.3-2","44.3-3","44.3-4","44.3-5","44.4-1","44.5-1","44.5-2","44.7-1","44.7-2","44.8-1","44.9-1","44.9-2","44~beta-1","44~rc-1","45.0-1","45.1-1","45.2-1","45.2-2","45.3-1","45.3-2","45~rc-1","46.0-1","46.0-2","46.1-1","46.2-1","46.3.1-1","46.3.1-2","46.3.1-3","46.3.1-4","46.4-1","47.0-1","47.0-2","47.0-3","47.1-1","47.1-2","47.2-1","47.2-2","47.3-1","47~beta-1","47~rc-1","47~rc-3","48.0-1","48.1-1","48.2-1","48.2-2","48.2-3","48.3-1","48.4-1","48.4-1~deb13u1","48.5-1","48.5-2","48.5-3","48~beta-1","48~beta-2","48~beta-3","48~beta-4","48~rc-1","48~rc-2","49.0-1","49.0-2","49.1-1","49.1-2","49.1-4","49.1-5","49.2-1","49.2-2","49.3-1","49.3-2","49.3-3","49.4-1","49.5-1","50.0-1","50.2-2","50.2-3","50.3-1","50.4-1","50.5-1","51.0-1","51.0-2","51.0-3"]},{"source":"osv","ecosystem":"Debian:13","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["48.3-1","48.4-1","48.4-1~deb13u1","48.5-1","48.5-2","48.5-3","48.7-0+deb13u1","48.7-0+deb13u2","49.0-1","49.0-2","49.1-1","49.1-2","49.1-4","49.1-5","49.2-1","49.2-2","49.3-1","49.3-2","49.3-3","49.4-1","49.5-1","50.0-1","50.2-2","50.2-3","50.3-1","50.4-1","50.5-1","51.0-1","51.0-2","51.0-3"]},{"source":"osv","ecosystem":"Debian:14","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"50.5-1"}]}],"versions":["48.3-1","48.4-1","48.4-1~deb13u1","48.5-1","48.5-2","48.5-3","49.0-1","49.0-2","49.1-1","49.1-2","49.1-4","49.1-5","49.2-1","49.2-2","49.3-1","49.3-2","49.3-3","49.4-1","49.5-1","50.0-1","50.2-2","50.2-3","50.3-1","50.4-1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"44.6-4.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"44.6-4.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.38.4-5.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"44.6-4.oe2403sp1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"48.4-160000.2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"48.4-160000.2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.4-77.31.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.3-150700.11.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.3-150700.11.6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.16.4-0ubuntu1","3.18.1-1ubuntu1","3.18.2-0ubuntu1","3.18.2-0ubuntu2","3.18.3-3ubuntu1","3.18.4-0ubuntu1","3.18.4-0ubuntu2","3.18.4-0ubuntu3","3.18.5-0ubuntu0.1","3.18.5-0ubuntu0.2","3.18.5-0ubuntu0.3","3.18.5-0ubuntu0.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.26.1-0ubuntu4","3.26.1-0ubuntu5","3.26.1-0ubuntu6","3.26.2-0ubuntu1","3.26.2-0ubuntu2","3.26.2-0ubuntu3","3.27.91-0ubuntu1","3.27.92-0ubuntu1","3.28.0-0ubuntu1","3.28.0-0ubuntu2","3.28.0-0ubuntu3","3.28.0-0ubuntu4","3.28.0-0ubuntu5","3.28.1-0ubuntu1","3.28.1-0ubuntu2","3.28.2-0ubuntu0.18.04.1","3.28.3-0ubuntu0.18.04.2","3.28.3-0ubuntu0.18.04.3","3.28.3-0ubuntu0.18.04.4","3.28.3+git20190124-0ubuntu18.04.1","3.28.3+git20190124-0ubuntu18.04.2","3.28.4-0ubuntu18.04.1","3.28.4-0ubuntu18.04.2","3.28.4-0ubuntu18.04.3","3.28.4-0ubuntu18.04.7"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.34.1-1ubuntu1","3.34.1+git20191024-1ubuntu1","3.34.3-1ubuntu1","3.35.91-1ubuntu2","3.36.0-2ubuntu1","3.36.0-2ubuntu2","3.36.1-4ubuntu1","3.36.1-5ubuntu1","3.36.1-5ubuntu2","3.36.2-1ubuntu1~20.04.1","3.36.3-1ubuntu1~20.04.2","3.36.4-1ubuntu1~20.04.1","3.36.4-1ubuntu1~20.04.2","3.36.7-0ubuntu0.20.04.1","3.36.9-0ubuntu0.20.04.1","3.36.9-0ubuntu0.20.04.2","3.36.9-0ubuntu0.20.04.3","3.36.9-0ubuntu0.20.04.4","3.36.9-0ubuntu0.20.04.5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.9-0ubuntu2.4"}]}],"versions":["40.5-1ubuntu2","41.3-1ubuntu1","42~beta-1ubuntu2","42~beta-1ubuntu3","42.0-1ubuntu1","42.0-2ubuntu1","42.1-0ubuntu0.1","42.2-0ubuntu0.2","42.4-0ubuntu0.22.04.1","42.5-0ubuntu1","42.9-0ubuntu2","42.9-0ubuntu2.1","42.9-0ubuntu2.2","42.9-0ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"46.0-0ubuntu6~24.04.17"}]}],"versions":["45.0-1ubuntu2","45.1-1ubuntu1","45.2-1ubuntu1","45.3-1ubuntu1","46.0-0ubuntu3.1","46.0-0ubuntu4","46.0-0ubuntu5","46.0-0ubuntu5.1","46.0-0ubuntu6~24.04.1","46.0-0ubuntu6~24.04.3","46.0-0ubuntu6~24.04.4","46.0-0ubuntu6~24.04.5","46.0-0ubuntu6~24.04.6","46.0-0ubuntu6~24.04.8","46.0-0ubuntu6~24.04.9","46.0-0ubuntu6~24.04.11","46.0-0ubuntu6~24.04.12","46.0-0ubuntu6~24.04.13","46.0-0ubuntu6~24.04.14","46.0-0ubuntu6~24.04.15","46.0-0ubuntu6~24.04.16"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"50.1-0ubuntu1.5"}]}],"versions":["49.0-1ubuntu1","49.1-5ubuntu1","49.2-1ubuntu1","49.2-1ubuntu2","50~beta-0ubuntu3","50.0-0ubuntu2","50.0-1ubuntu1","50.0-1ubuntu2","50.0-1ubuntu3","50.1-0ubuntu1","50.1-0ubuntu1.1","50.1-0ubuntu1.2","50.1-0ubuntu1.3","50.1-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.9-0ubuntu2.4"}]}],"versions":["40.5-1ubuntu2","41.3-1ubuntu1","42~beta-1ubuntu2","42~beta-1ubuntu3","42.0-1ubuntu1","42.0-2ubuntu1","42.1-0ubuntu0.1","42.2-0ubuntu0.2","42.4-0ubuntu0.22.04.1","42.5-0ubuntu1","42.9-0ubuntu2","42.9-0ubuntu2.1","42.9-0ubuntu2.2","42.9-0ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"46.0-0ubuntu6~24.04.17"}]}],"versions":["45.0-1ubuntu2","45.1-1ubuntu1","45.2-1ubuntu1","45.3-1ubuntu1","46.0-0ubuntu3.1","46.0-0ubuntu4","46.0-0ubuntu5","46.0-0ubuntu5.1","46.0-0ubuntu6~24.04.1","46.0-0ubuntu6~24.04.3","46.0-0ubuntu6~24.04.4","46.0-0ubuntu6~24.04.5","46.0-0ubuntu6~24.04.6","46.0-0ubuntu6~24.04.8","46.0-0ubuntu6~24.04.9","46.0-0ubuntu6~24.04.11","46.0-0ubuntu6~24.04.12","46.0-0ubuntu6~24.04.13","46.0-0ubuntu6~24.04.14","46.0-0ubuntu6~24.04.15","46.0-0ubuntu6~24.04.16"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"50.1-0ubuntu1.5"}]}],"versions":["49.0-1ubuntu1","49.1-5ubuntu1","49.2-1ubuntu1","49.2-1ubuntu2","50~beta-0ubuntu3","50.0-0ubuntu2","50.0-1ubuntu1","50.0-1ubuntu2","50.0-1ubuntu3","50.1-0ubuntu1","50.1-0ubuntu1.1","50.1-0ubuntu1.2","50.1-0ubuntu1.3","50.1-0ubuntu1.4"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"48.4-160000.2.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-91786","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533606","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/9365"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91786","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f22f-r8xp-wr6f"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-91786","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4854","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4855","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4856","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4857","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623950-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1280619","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-91786","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264350-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264373-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-91786","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-91786","tags":["report"]},{"url":"https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/4418","tags":["report"]},{"url":"https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/4417","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8971-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-91786","title":"Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size","description":"A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory.","status":"published","published":"2026-09-15T11:00:53.131Z","modified":"2026-11-06T01:46:34.247Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-06T02:55:55.947181Z"}],"euvd":[{"id":"EUVD-2026-78417","description":"A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory.","status":"published","published":"2026-09-15T11:00:53Z","modified":"2026-11-06T01:46:34Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T03:02:58.554056Z"}],"ghsa":[{"id":"GHSA-f22f-r8xp-wr6f","title":"A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus,...","description":"A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory.","status":"published","published":"2026-09-15T12:31:47Z","modified":"2026-09-15T12:31:54Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:11:54.134441Z"}],"nvd":[{"id":"CVE-2026-91786","description":"A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory.","status":"published","published":"2026-09-15T11:17:12.58Z","modified":"2026-11-06T02:17:57.793Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-06T06:59:05.303911Z"}],"osv":[{"id":"DEBIAN-CVE-2026-91786","description":"A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory.","status":"published","published":"2026-09-15T11:17:12.58Z","modified":"2026-11-06T17:31:05.423105491Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T18:00:26.717991Z"},{"id":"OESA-2026-4854","title":"gnome-shell security update","description":"The GNOME Shell redefines user interactions with the GNOME desktop. In particular, it offers new paradigms for launching applications, accessing documents, and organizing open windows in GNOME. Later, it will introduce a new applets eco-system and offer new solutions for other desktop features, such as notifications and contacts management. The GNOME Shell is intended to replace functions handled by the GNOME Panel and by the window manager in previous versions of GNOME. The GNOME Shell has rich visual effects enabled by new graphical technologies.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon\u0026apos;s declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user\u0026apos;s session, and potentially disclose sensitive information from adjacent memory.(CVE-2026-91786)","status":"published","published":"2026-11-11T12:26:52Z","modified":"2026-11-11T12:45:12.57042419Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"OESA-2026-4855","title":"gnome-shell security update","description":"The GNOME Shell redefines user interactions with the GNOME desktop. In particular, it offers new paradigms for launching applications, accessing documents, and organizing open windows in GNOME. Later, it will introduce a new applets eco-system and offer new solutions for other desktop features, such as notifications and contacts management. The GNOME Shell is intended to replace functions handled by the GNOME Panel and by the window manager in previous versions of GNOME. The GNOME Shell has rich visual effects enabled by new graphical technologies.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon\u0026apos;s declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user\u0026apos;s session, and potentially disclose sensitive information from adjacent memory.(CVE-2026-91786)","status":"published","published":"2026-11-11T12:26:52Z","modified":"2026-11-11T12:45:12.271804611Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"OESA-2026-4856","title":"gnome-shell security update","description":"The GNOME Shell redefines user interactions with the GNOME desktop. In particular, it offers new paradigms for launching applications, accessing documents, and organizing open windows in GNOME. Later, it will introduce a new applets eco-system and offer new solutions for other desktop features, such as notifications and contacts management. The GNOME Shell is intended to replace functions handled by the GNOME Panel and by the window manager in previous versions of GNOME. The GNOME Shell has rich visual effects enabled by new graphical technologies.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon\u0026apos;s declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user\u0026apos;s session, and potentially disclose sensitive information from adjacent memory.(CVE-2026-91786)","status":"published","published":"2026-11-11T12:26:53Z","modified":"2026-11-11T12:45:09.360499188Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"OESA-2026-4857","title":"gnome-shell security update","description":"The GNOME Shell redefines user interactions with the GNOME desktop. In particular, it offers new paradigms for launching applications, accessing documents, and organizing open windows in GNOME. Later, it will introduce a new applets eco-system and offer new solutions for other desktop features, such as notifications and contacts management. The GNOME Shell is intended to replace functions handled by the GNOME Panel and by the window manager in previous versions of GNOME. The GNOME Shell has rich visual effects enabled by new graphical technologies.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon\u0026apos;s declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user\u0026apos;s session, and potentially disclose sensitive information from adjacent memory.(CVE-2026-91786)","status":"published","published":"2026-11-11T12:26:54Z","modified":"2026-11-11T12:45:12.269808877Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"UBUNTU-CVE-2026-91786","description":"A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory.","status":"published","published":"2026-09-15T11:17:00Z","modified":"2026-11-03T21:17:30.977791923Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T21:43:54.166508Z"},{"id":"openSUSE-SU-2026:21976-1","title":"Security update for gnome-shell","description":"This update for gnome-shell fixes the following issue:\n\n- CVE-2026-91786: missing dimension validation when processing icons from a remote search provider via D-Bus can lead to\n  an out-of-bounds read (bsc#1280619).\n","status":"published","published":"2026-09-29T17:42:02Z","modified":"2026-10-01T18:23:09.929480274Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23950-1","title":"Security update for gnome-shell","description":"This update for gnome-shell fixes the following issue:\n\n- CVE-2026-91786: missing dimension validation when processing icons from a remote search provider via D-Bus can lead to\n  an out-of-bounds read (bsc#1280619).\n","status":"published","published":"2026-09-29T17:44:43Z","modified":"2026-10-02T18:23:11.103730901Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:4350-1","title":"Security update for gnome-shell","description":"This update for gnome-shell fixes the following issue:\n\n- CVE-2026-91786: missing dimension validation when processing icons from a remote search provider via D-Bus can lead to\n  an out-of-bounds read (bsc#1280619).\n","status":"published","published":"2026-09-25T14:16:49Z","modified":"2026-09-26T09:30:03.767342461Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4373-1","title":"Security update for gnome-shell","description":"This update for gnome-shell fixes the following issue:\n\n- CVE-2026-91786: missing dimension validation when processing icons from a remote search provider via D-Bus can lead to\n  an out-of-bounds read (bsc#1280619).\n","status":"published","published":"2026-09-28T15:11:52Z","modified":"2026-09-29T09:15:10.894890127Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"USN-8971-1","title":"gnome-shell vulnerability","description":"It was discovered that GNOME Shell did not properly validate icon\ndimensions when processing icons from a remote search provider. An\nattacker could possibly use this issue to cause GNOME Shell to crash,\nresulting in a denial of service, or expose sensitive information from\nmemory.","status":"published","published":"2026-11-03T14:13:50Z","modified":"2026-11-04T03:43:10.422376083Z","updated_at":"2026-11-04T03:56:18.279609Z"}]}}