Ubuntu patches GNOME Shell icon validation flaw enabling DoS, memory leaks

Ubuntu has released security updates for GNOME Shell across three LTS releases to address CVE-2026-91786, a vulnerability in how the desktop environment processes icons from remote search providers. The flaw stems from insufficient validation of icon dimensions, which can be triggered by maliciously crafted input from a remote source. Successful exploitation results in either a denial of service through GNOME Shell crashes or exposure of sensitive information from memory.

The fix is available for Ubuntu 26.04 LTS (resolute), 24.04 LTS (noble), and 22.04 LTS (jammy), with patched package versions 50.1-0ubuntu1.5, 46.0-0ubuntu6~24.04.17, and 42.9-0ubuntu2.4 respectively. Users must restart their session after updating to apply the changes fully. The vulnerability is remotely exploitable through the search provider mechanism, making it particularly relevant for systems with remote search integrations enabled.

Vulnerability mechanics and affected versions

• CVE-2026-91786: The vulnerability is tracked under this single CVE identifier, indicating a unified defect rather than multiple distinct issues.
• Attack vector: Remote, via specially crafted icon data supplied through GNOME Shell's remote search provider interface; no local access required.
• Defect class: Improper input validation — specifically, missing or insufficient bounds checking on icon dimensions before processing.
• Impact variants: Two distinct outcomes possible: denial of service (GNOME Shell crash) or information disclosure (sensitive memory contents exposed).
• Affected releases: Ubuntu 22.04 LTS (GNOME Shell 42.9), 24.04 LTS (GNOME Shell 46.0), and 26.04 LTS (GNOME Shell 50.1) all received patched packages with specific version increments.

Why it matters

This vulnerability affects one of the most widely deployed Linux desktop environments, making it significant for enterprise workstations, developer machines, and any Ubuntu-based distribution pulling from the same package repositories. The remote attack vector through search providers is particularly concerning for organizations using GNOME's online account integrations or custom enterprise search backends. The coordinated patch across three LTS releases demonstrates Ubuntu's continued commitment to extended security maintenance for desktop components, though the requirement for session restart may delay protection on multi-user or kiosk systems where users remain logged in.