Your message dated Thu, 17 Sep 2026 22:21:28 +0100
with message-id <[email protected]>
and subject line Re: Bug#1148176: gnome-shell: CVE-2026-91786
has caused the Debian Bug report #1148176,
regarding gnome-shell: CVE-2026-91786
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1148176: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148176
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: gnome-shell
Version: 50.4-1
Severity: important
Tags: security upstream
Forwarded: https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/9365
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for gnome-shell.
CVE-2026-91786[0]:
| A flaw was found in GNOME Shell. When processing icons from a remote
| search provider via D-Bus, the system fails to validate the icon's
| declared dimensions against the actual data buffer size. A malicious
| or compromised remote search provider could exploit this by
| providing oversized icon dimensions, leading to an out-of-bounds
| read. This can cause the GNOME Shell process to crash, disrupting
| the user's session, and potentially disclose sensitive information
| from adjacent memory.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-91786
https://www.cve.org/CVERecord?id=CVE-2026-91786
[1] https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/9365
[2] https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/4417
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Version: 50.5-1
On Thu, 17 Sep 2026 at 22:20:41 +0200, Salvatore Bonaccorso wrote:
| A flaw was found in GNOME Shell. When processing icons from a remote
| search provider via D-Bus, the system fails to validate the icon's
| declared dimensions against the actual data buffer size. A malicious
| or compromised remote search provider could exploit this
This appears to have been fixed in 50.5 and 51.0 upstream.
According to discussion upstream, probably a more important attack route
is that if a sandboxed app is given direct access to
org.freedesktop.Notifications (as opposed to xdg-desktop-portal's
org.freedesktop.portal.Notification, which is designed to be used by
semi-trusted sandboxed apps, and validates the icon), it could present a
malformed icon data blob that way.
smcv
--- End Message ---
