Skip to content
fr Sign in
8.8 High

CVE-2026-94422 An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass…

Description

An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.

Affected products and versions

Product Affected versions Fixed in
Fedora 0.1 earliest → < 0.1.9 0.1.9
Red Hat Enterprise Linux 9 Versions not published
Red Hat Enterprise Linux 10 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Fedora

The 83 CVEs of Fedora →
CVE-2026-19816 A flaw was found in PackageKit 7.1 High CVE-2026-19624 A flaw was found in NetworkManager-l2tp 7.8 High CVE-2023-4235 A flaw was found in ofono, an Open Source Telephony on Linux 8.1 High CVE-2023-4234 A flaw was found in ofono, an Open Source Telephony on Linux 8.1 High
Track this CVE