CVE-2026-91786

EUVD-2026-78417
A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.1 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 2.69%
Debian logo
Debian Releases
Debian Product
Codename
gnome-shell
bookworm
unimportant
bookworm (security)
unimportant
forky
50.5-1
fixed
sid
51.0-3
fixed
trixie
unimportant
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
gnome-shell
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
stonking
not-affected
xenial
needs-triage
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
gnome-extensions
suse enterprise desktop 15 SP7
45.3-150700.11.6.1
fixed
suse enterprise sap 15 SP7
45.3-150700.11.6.1
fixed
suse enterprise server 15 SP7
45.3-150700.11.6.1
fixed
gnome-shell
suse enterprise desktop 15 SP7
45.3-150700.11.6.1
fixed
suse enterprise sap 12 SP5
3.20.4-77.31.2
fixed
suse enterprise sap 15 SP7
45.3-150700.11.6.1
fixed
suse enterprise server 12 SP3
3.20.4-77.31.2
fixed
suse enterprise server 12 SP5
3.20.4-77.31.2
fixed
suse enterprise server 15 SP7
45.3-150700.11.6.1
fixed
gnome-shell-browser-plugin
suse enterprise sap 12 SP5
3.20.4-77.31.2
fixed
suse enterprise server 12 SP3
3.20.4-77.31.2
fixed
suse enterprise server 12 SP5
3.20.4-77.31.2
fixed
gnome-shell-devel
suse enterprise desktop 15 SP7
45.3-150700.11.6.1
fixed
suse enterprise sap 12 SP5
3.20.4-77.31.2
fixed
suse enterprise sap 15 SP7
45.3-150700.11.6.1
fixed
suse enterprise server 12 SP5
3.20.4-77.31.2
fixed
suse enterprise server 15 SP7
45.3-150700.11.6.1
fixed
gnome-shell-lang
suse enterprise desktop 15 SP7
45.3-150700.11.6.1
fixed
suse enterprise sap 12 SP5
3.20.4-77.31.2
fixed
suse enterprise sap 15 SP7
45.3-150700.11.6.1
fixed
suse enterprise server 12 SP3
3.20.4-77.31.2
fixed
suse enterprise server 12 SP5
3.20.4-77.31.2
fixed
suse enterprise server 15 SP7
45.3-150700.11.6.1
fixed
Common Weakness Enumeration
References
https://access.redhat.com/security/cve/CVE-2026-91786
https://bugzilla.redhat.com/show_bug.cgi?id=2533606
https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/9365