A flaw in the gvfs SFTP backend allows a malicious server to trigger the client to use uninitialized heap memory as a file handle. The client then echoes these garbage bytes back to the server on subsequent requests, enabling the attacker to deterministically read portions of the gvfsd-sftp process’s heap. With 128‐byte reads the attacker can expose the process’s heap base and the load address of the libgio library, defeating ASLR and exposing sensitive memory contents.

The vulnerability affects the gvfs component shipped with Red Hat Enterprise Linux versions 6 through 10. Any system running these RHEL releases that uses gvfs to connect to SFTP servers is impacted. Specific gvfs versions are not listed, so all bundled builds within these OS releases are considered at risk.

The CVSS score of 4.3 indicates moderate severity. Exploit probability is unknown because EPSS data is unavailable, and the CVE is not listed in the CISA KEV catalog. Likely exploitation requires an attacker to operate an untrusted SFTP server that a gvfs client connects to, making the threat most relevant in environments where users routinely mount remote SFTP shares over insecure or uncontrolled networks. The absence of a patch means the only mitigations are to avoid untrusted connections and to apply later vendor updates when available.