The GNOME Project has announced GNOME 50.4 as the fourth maintenance update to the GNOME 50 desktop series, containing several noteworthy security changes, particularly in GDM 50.2, fixing a path traversal vulnerability where a compromised greeter could load arbitrary .desktop files using the SelectSession interface.
GDM 50.2 also closes an autologin bypass that let a compromised greeter request automatic login for any local account by supplying arbitrary usernames through BeginAutoLogin. Another denial-of-service issue was fixed where an invalid session name sent by the greeter could cause the entire GDM daemon to terminate, ending all active user sessions.
Password handling has been further hardened as well. Cached plaintext passphrases are now wiped from memory before release, and bounds checks were added to prevent out-of-bounds reads when walking through keyring buffers. Plus, several crashes, memory leaks, and reauthentication problems have been fixed.
GNOME 50.4 also includes GLib 2.88.3, which fixes CVE-2026-15588, a pre-authentication denial-of-service vulnerability in GDBusServer. The issue involved unbounded buffering of SASL authentication lines from a client. The update limits line length, preventing a remote client from continuously consuming memory before authentication completes.
Moreover, GLib 2.88.3 removes the inappropriate use of the G_GNUC_CONST attribute from certain type-related functions, avoiding potential miscompilation with GCC 17, and includes several Meson, compiler, and macOS-specific fixes.
On the desktop side, GNOME Shell 50.4 fixes a visual glitch that could appear when switching to a minimized window on another workspace. It also corrects an improperly scaled cursor when using the screen magnifier on HiDPI displays.
Additional Shell fixes improve several menu animations, eliminate a sound glitch caused by redundant volume-change requests, and fix the removal of search providers when an unregistered provider was involved. The release also includes smaller fixes and internal cleanups.
Mutter 50.4, GNOME’s window and compositing manager, fixes blurred rendering on monitor configurations not perfectly aligned to physical pixels. It also stops advertising unsupported fallback monitor modes and fixes invalid redraw regions on rotated displays.
HDR handling has improved by populating mastering-display metadata in the compositor’s HDR output. The Mutter update also fixes several crashes and includes more compositor cleanups and reliability improvements.
GVfs 1.60.2 strengthens input validation throughout its AFP, WebDAV, FTP, MTP, and SFTP backends. Password strings are now cleared from memory before being freed, and crashes affecting the OneDrive, MTP, and SMB backends have been fixed.
GNOME Control Center has also been updated to version 50.4, while libadwaita 1.9.3 resolves minor interface issues affecting the About dialog, Sidebar, Tab Overview, and adaptive window previews.
Other updated components include at-spi2-core 2.60.6, gexiv2 0.16.2, GNOME Initial Setup 50.1, GNOME User Documentation 50.4, libshumate 1.6.3, and VTE 0.84.1. In total, GNOME 50.4 ships new versions of 14 components.
For additional details, visit the announcement or review all the changes here.
