AZL-105923

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-105923.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-105923

Upstream

CVE-2026-94422

Published

2026-10-02T14:17:12Z

Modified

2026-10-03T14:16:43Z

Summary

CVE-2026-94422 affecting package xdg-dbus-proxy 0.1.6-2

Details

An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-94422

Affected packages

Azure Linux:3 / xdg-dbus-proxy

Package

Name: xdg-dbus-proxy
Purl: pkg:rpm/azure-linux/xdg-dbus-proxy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

0.1.6-2

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-105923.json"