Vulnerability · Published Sep 15, 2026 · Assigned by redhat
CVE-2026-91786Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size
Medium 6.1
In plain English
A medium-severity out-of-bounds read in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | gnome-shell | no fix listed | DEBIAN-CVE-2026-91786 |
| Debian:13 | gnome-shell | no fix listed | DEBIAN-CVE-2026-91786 |
| Debian:14 | gnome-shell | 50.5-1 | DEBIAN-CVE-2026-91786 |
| Ubuntu:22.04:LTS | gnome-shell | 42.9-0ubuntu2.4 | UBUNTU-CVE-2026-91786 |
| Ubuntu:22.04:LTS | gnome-shell | 42.9-0ubuntu2.4 | USN-8971-1 |
| Ubuntu:24.04:LTS | gnome-shell | 46.0-0ubuntu6~24.04.17 | USN-8971-1 |
| Ubuntu:24.04:LTS | gnome-shell | 46.0-0ubuntu6~24.04.17 | UBUNTU-CVE-2026-91786 |
| Ubuntu:26.04:LTS | gnome-shell | 50.1-0ubuntu1.5 | USN-8971-1 |
| Ubuntu:26.04:LTS | gnome-shell | 50.1-0ubuntu1.5 | UBUNTU-CVE-2026-91786 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
References
- https://access.redhat.com/security/cve/CVE-2026-91786 vdb-entry, x_refsource_REDHAT
- RHBZ#2533606 issue-tracking, x_refsource_REDHAT
- https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/9365