{"id":"CVE-2026-91786","aliases":[],"cve":{"records":[{"id":"CVE-2026-91786","source":"redhat","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-15T07:01:45.215Z","published":"2026-09-15T11:00:53.131Z","modified":"2026-11-06T01:46:34.247Z"}],"publishers":[{"name":"redhat","role":"CNA","organizationId":"53f830b8-0a3f-465b-8143-3b8a9948e749","modified":"2026-11-06T01:46:34.247Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-09-15T13:52:09.322Z"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-91786","tags":["vdb-entry","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533606","tags":["issue-tracking","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/9365","tags":[],"source":"redhat"}],"weaknesses":[{"id":"CWE-125","description":"Out-of-bounds Read","source":"redhat"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-09-15T13:25:05.872453Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size","titleSource":"redhat","descriptionSource":"redhat","description":"A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory.","score":6.1,"severity":"medium","published":"2026-09-15T11:00:53.131Z","modified":"2026-11-06T01:46:34.247Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 10","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux:10"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-91786"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 7","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/o:redhat:rhel_els:7"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-91786"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 8","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux:8"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-91786"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 9","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux:9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-91786"}],"remediation":[{"text":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-91786"}],"references":["https://access.redhat.com/security/cve/CVE-2026-91786","https://bugzilla.redhat.com/show_bug.cgi?id=2533606","https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/9365"],"sources":[{"name":"CVE","id":"CVE-2026-91786","modified":"2026-11-06T01:46:34.247Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-91786"}],"assessments":[{"source":"redhat","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","score":6.1}],"sourceAffected":[],"observedAt":"2026-11-06T02:14:00.075Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:00:32.916Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-06T02:15:39.490Z","attemptedAt":"2026-11-06T02:15:39.490Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-06T02:15:39.641Z","attemptedAt":"2026-11-06T02:15:39.641Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-06T02:15:39.723Z","attemptedAt":"2026-11-06T02:15:39.723Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-06T02:15:39.889Z","attemptedAt":"2026-11-06T02:15:39.889Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-91786","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91786","modified":"2026-09-16T19:42:43.623","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","checkedAt":"2026-11-06T02:15:39.490Z"},{"source":"GitHub Advisory Database","id":"GHSA-f22f-r8xp-wr6f","url":"https://github.com/advisories/GHSA-f22f-r8xp-wr6f","modified":"2026-09-15T12:31:54Z","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","checkedAt":"2026-11-06T02:15:39.641Z"},{"source":"ENISA EUVD","id":"EUVD-2026-78417","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-78417","modified":"Sep 15, 2026, 1:52:09 PM","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","checkedAt":"2026-11-06T02:15:39.723Z"},{"source":"FIRST EPSS","id":"CVE-2026-91786","url":"https://www.first.org/epss/","probability":0.00131,"percentile":0.02726,"date":"2026-11-05","checkedAt":"2026-11-06T02:15:39.889Z"}],"aiSummary":{"text":"A flaw in GNOME Shell allows an out-of-bounds read when processing icons from a remote search provider, potentially crashing the process and disclosing sensitive information. The issue occurs due to unvalidated icon-data buffer size. Affected products include Red Hat Enterprise Linux 7, 8, 9, and 10.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-06T02:16:18.601Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-91786"}]}}