CVE-2026-91786
A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's decl…
A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory.
Why it matters
- ▸ Requires local access, limiting mass exploitation
- ▸ Low attack complexity — no special conditions needed to exploit
- ▸ No authentication required
- ▸ Requires the victim to take an action (e.g. open a file or link)
Apply the vendor patch as soon as it's available or already released. User-awareness training reduces risk here, since exploitation depends on tricking a user into acting.
This analysis is generated from structured CVSS vector data, CISA KEV cross-referencing, and vendor/product category rules — not a manual expert review. Treat it as a starting point, not a substitute for your own assessment.
CVSS Vector Breakdown
Stay Updated
New CVEs and vulnerability advisories are added continuously as they're disclosed. Subscribe via RSS to get every update the moment it's published — no email or account required.
Subscribe via RSS