# Ubuntu releases security updates for GVfs to address SFTP, AFP, and MTP vulnerabilities

> **Key takeaway:** Security patches for the GVfs userspace virtual file system address vulnerabilities that could lead to information disclosure or denial of service via malicious remote servers or MTP devices.

**Published:** 2026-11-03T14:06:15+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/ubuntu-releases-security-updates-for-gvfs-to-address-sftp-af.html 

## Summary
Canonical has issued security updates for the GVfs (Gnome Virtual File System) package across three major Ubuntu Long Term Support (LTS) releases. The vulnerabilities involve improper data validation when interacting with specific network protocols and hardware devices.

Users running Ubuntu 22.04 LTS, 24.04 LTS, or 26.04 LTS are affected. The fixes address risks ranging from sensitive information leakage during SFTP connections to denial of service attacks triggered by malformed AFP replies or malicious MTP devices.

## Vulnerability details and patched versions
- **SFTP Information Disclosure (CVE-2026-84267):** GVfs failed to properly validate data returned by an SFTP server, potentially allowing a remote attacker to obtain sensitive information.
- **AFP Denial of Service (CVE-2026-84269):** Improper validation of reply sizes from Apple Filing Protocol (AFP) servers could allow a remote attacker to cause a denial of service.
- **MTP Denial of Service (CVE-2026-84270):** A failure to validate data size returned by Media Transfer Protocol (MTP) devices allows a malicious physical device to trigger a denial of service.
- **Affected Package Versions:** Fixes are included in gvfs 1.60.0-1ubuntu0.2 (26.04 LTS), 1.54.4-0ubuntu1~24.04.5 (24.04 LTS), and 1.48.2-0ubuntu1.3 (22.04 LTS).

## Why it matters
Since GVfs is a core component of the GNOME desktop environment and handles file operations for many Linux users, these patches are critical for maintaining system stability and data privacy. Users must perform a standard system update and restart their session to ensure the patched libraries are correctly loaded into the running environment.