CVE-2026-91786

Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size

State: Published
Severity: 6.1 Medium
Published: Sep 15, 2026
Updated: Sep 15, 2026
Reserved: Sep 15, 2026

Description

A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory.

Scores

CVSS	Score	Vector	Source
3.1	6.1 Medium	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H	redhat

Weaknesses

CWE-125 Out-of-bounds Read

Affected Products

Product	Versions
Red Hat Enterprise Linux 10Red Hat
Red Hat Enterprise Linux 7Red Hat
Red Hat Enterprise Linux 8Red Hat
Red Hat Enterprise Linux 9Red Hat

References

https://access.redhat.com/security/cve/CVE-2026-91786vdb-entry
RHBZ#2533606issue-tracking
https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/9365

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.