Description
An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
xdg-dbus-proxy
Default version status: unaffected
0 to < 0.1.9affected
Fedora Fedora
Default version status: unaffected
0 to < 0.1.9affected
Red Hat Red Hat Enterprise Linux 9
Default version status: affected
Red Hat Red Hat Enterprise Linux 10
Default version status: affected
References
- https://access.redhat.com/security/cve/CVE-2026-94422 ↗
- https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-2cgv-pwcq-wvpq ↗
- https://github.com/flatpak/xdg-dbus-proxy/commit/e5702fca4dba9600721921fbca2dbc39dc5ca400 ↗
- https://github.com/flatpak/xdg-dbus-proxy/commit/fc027f759316fb2a6c45648200b6f100202eb84e ↗
- https://github.com/flatpak/xdg-dbus-proxy/commit/e4465a0dfe96da3b39929a30a1ac3a22b16223e3 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2542235 ↗
- http://www.openwall.com/lists/oss-security/2026/09/23/5 ↗
- https://lists.debian.org/debian-lts-announce/2026/10/msg00050.html ↗