CVE-2026-94422
Received Received - Intake

Incorrect Message Filtering in xdg-dbus-proxy Allows Code Execution

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: redhat-SADP

Description
An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-94422
EUVD
EUVD-2026-91646

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
xdg-dbus-proxy xdg-dbus-proxy to 0.1.9 (exc)
flatpak xdg-dbus-proxy to 0.1.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-94422 is a flaw in xdg-dbus-proxy versions before 0.1.9 where message filtering is incorrectly implemented. The proxy assumes only reply messages contain a reply-serial field, but non-reply messages can also set this field. This allows a malicious Flatpak app to forge replies, potentially tricking the system into executing arbitrary code outside the sandbox.

Detection Guidance

To detect this vulnerability, check the installed version of xdg-dbus-proxy. Run: dpkg -l xdg-dbus-proxy or rpm -q xdg-dbus-proxy. If the version is below 0.1.9, the system is vulnerable. Additionally, monitor D-Bus traffic for unexpected reply serials on non-reply messages using tools like dbus-monitor.

Impact Analysis

If exploited, this vulnerability could allow a compromised Flatpak app to escape its sandbox and execute arbitrary code on your system. This could lead to full loss of confidentiality, integrity, and availability of your host system. Attackers could gain control over your system by manipulating D-Bus messages.

Compliance Impact

This vulnerability primarily affects sandboxing mechanisms in applications like Flatpak and Firejail, enabling unauthorized code execution outside restricted environments. While it does not directly violate GDPR or HIPAA, it could indirectly impact compliance by compromising data confidentiality and integrity if malicious code executes outside sandboxed environments where sensitive data is processed.

Mitigation Strategies

Upgrade xdg-dbus-proxy to version 0.1.9 or later to address the vulnerability. Avoid running untrusted Flatpak apps or other frameworks that rely on xdg-dbus-proxy for sandboxing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94422. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart