GNOME 50.5 Patch Fixes gvfs CVE and Epiphany Code Injection

The GNOME Release Team officially launched GNOME 50.5 on September 24, delivering a critical update that addresses several security vulnerabilities across its core ecosystem. This release updates 22 modules and targets specific flaws in the gvfs file system layer, the Epiphany web browser, and the librsvg image library. The team emphasized the urgency of these patches, stating, “All operating systems shipping GNOME 50 are encouraged to upgrade.” Users relying on Epiphany for browsing, librsvg for viewing SVG images, or gvfs for file access remain vulnerable until their respective distributions integrate these new packages.

Securing the Web Browser and File System

Epiphany advances from version 50.4 to 50.6 within this release cycle, incorporating two significant August updates. Version 50.6, released on August 13, resolves a JavaScript code injection vulnerability triggered by CSS selectors in the autofill feature. It also addresses a path traversal flaw in WebExtension XPI files known as ZIPSLIP. In a ZIP slip attack, a maliciously crafted archive can write files outside its designated directory, potentially allowing an extension package to place files elsewhere on the disk. Additionally, version 50.5 introduces quoting mechanisms for command-line input before Epiphany passes it to the shell. Both versions also resolve crashes associated with the password manager and invalid bookmark imports.

The gvfs component, specifically version 1.60.3, is the sole module assigned a Common Vulnerabilities and Exposures identifier in the release notes: CVE-2026-88924. The remediation involves ensuring the admin backend sets ownership on its socket prior to creation. The changelog provides only a single line of description for this fix without assigning a severity score, leaving system administrators to assess the risk level based on that limited entry.

Addressing Memory Corruption and Authentication Issues

Memory management errors were corrected in both the image rendering engine and the login manager. librsvg version 2.62.4 fixes a use-after-free bug, where a program continues to use memory that has already been released. This issue was triggered by duplicate XML entities found in nested XInclude documents. The librsvg update also incorporates updates to two Rust dependencies to address advisories RUSTSEC-2026-0187 and RUSTSEC-2026-0204.

The display manager, GDM version 50.3, rectifies two use-after-free bugs. One of these defects could cause a complete user session crash during screen lock or unlock operations. GDM also repairs a regression caused by a previous security patch that inadvertently broke authentication on systemd. Meanwhile, GNOME Shell version 50.5 now prevents screen unlocking after a screen time limit expires and cancels mount password dialogs when the screen locks. It also validates serialized image data before creating a pixbuf.

Further hardening efforts include updates to libgsf and libsecret. Version 1.14.59 of libgsf protects its OLE2 loader against runaway recursion and fixes zip reads on corrupted streams. The file backend for libsecret gains file locking capabilities to prevent concurrent writes from racing, ensuring data integrity during simultaneous access attempts.