CVE-2026-94422
- Source
- https://cve.org/CVERecord?id=CVE-2026-94422
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94422.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-94422
- Aliases
-
- GHSA-2cgv-pwcq-wvpq
- Downstream
- Related
- Published
- 2026-10-02T13:54:10Z
- Modified
- 2026-10-21T10:52:32Z
- Severity
-
- 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape
- Details
-
An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.
- Database specific
{ "cna_assigner": "redhat", "cwe_ids": [ "CWE-290" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94422.json" }- References
-
- http://www.openwall.com/lists/oss-security/2026/09/23/5
- https://access.redhat.com/downloads/content/package-browser/
- https://bodhi.fedoraproject.org/updates/?packages=xdg-dbus-proxy
- https://access.redhat.com/security/cve/CVE-2026-94422
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94422.json
- https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-2cgv-pwcq-wvpq
- https://nvd.nist.gov/vuln/detail/CVE-2026-94422
- https://bugzilla.redhat.com/show_bug.cgi?id=2542235
- https://github.com/flatpak/xdg-dbus-proxy/commit/e4465a0dfe96da3b39929a30a1ac3a22b16223e3
- https://github.com/flatpak/xdg-dbus-proxy/commit/e5702fca4dba9600721921fbca2dbc39dc5ca400
- https://github.com/flatpak/xdg-dbus-proxy/commit/fc027f759316fb2a6c45648200b6f100202eb84e
- https://github.com/flatpak/xdg-dbus-proxy
Affected packages
Git / github.com/flatpak/xdg-dbus-proxy
Affected ranges
- Type
- GIT
- Repo
- https://github.com/flatpak/xdg-dbus-proxy
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "0.1.9" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "fixed": "e5702fca4dba9600721921fbca2dbc39dc5ca400" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "fc027f759316fb2a6c45648200b6f100202eb84e" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "e4465a0dfe96da3b39929a30a1ac3a22b16223e3" } ], "source": "REFERENCES_COMMIT" } ] }
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94422.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "3872059813419332911623582239146802228",
"length": 3512
},
"id": "CVE-2026-94422-06dfd1c3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/flatpak/xdg-dbus-proxy/commit/e4465a0dfe96da3b39929a30a1ac3a22b16223e3",
"target": {
"file": "flatpak-proxy.c",
"function": "got_buffer_from_client"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "109805863521917563826914666317457881342",
"length": 3623
},
"id": "CVE-2026-94422-3c23b69b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/flatpak/xdg-dbus-proxy/commit/e5702fca4dba9600721921fbca2dbc39dc5ca400",
"target": {
"file": "flatpak-proxy.c",
"function": "got_buffer_from_bus"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "101886033121010108326922321989018429655",
"length": 2122
},
"id": "CVE-2026-94422-46a75169",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/flatpak/xdg-dbus-proxy/commit/e5702fca4dba9600721921fbca2dbc39dc5ca400",
"target": {
"file": "flatpak-proxy.c",
"function": "get_dbus_method_handler"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"127134279361651211749184328543913210960",
"337486799353005993079489573646304772057",
"188370337902503540877274226636131733100",
"232788530928053903451672664124925401104",
"20610826930346136413136781543501041530",
"256372287768280859925762222537935802055",
"131831148393761463044862078459516861069",
"167920545193598217516369221807918923829",
"43716606132098059869277431014950608571",
"24435506950946436315971327874175076740",
"76922988726776491791234578021032759573",
"89363628305835631992600715101084592243",
"324740915974462880594912301158845159366",
"250512143140547132997268645607772078142",
"122420013796902016447529928729424789124",
"145084444892359995733555873394128262477",
"296606038367697406351597808966371604180",
"185665542107147573229797442473716272063",
"71784831984648396085349975423346466610",
"220451391696150804343505222549306077735",
"296842231529096182385539091882341646146",
"218068596799798513206660921407431106305",
"2488850495567359348374012855065294150",
"257083081517036389715329790759647213916",
"301363334093071073893629514873285882441",
"311403205215382905692904426804922398893",
"19162300389541745662418892380722088576",
"204557512399652437300440656857127024013",
"178726226084795490542905069372383883111",
"157456838833113935332691732663676201461",
"271615934527598960329215525392800390899",
"42854485841203940042158708567484604513",
"82313991931199953268368926793697885215",
"106516262384340340970213020798410130183",
"102469718774798261547189425491015970319",
"87337221818857857188662322076762909548",
"127539200921787682095583116955048507997",
"332100610272335632486078497141716361612",
"6700531888899798426445757426789780200",
"1423734045920372675342220950174056211",
"303094307901699033400137288996938454871",
"155264034290448809916153048777029780700",
"217158036059248666479316719600674222494",
"317538862861971458486719846281640806137",
"210296538778857963972147768434528907608",
"325897983471046534238232940279512799342",
"14148962597212921380753190004792747033",
"78049841843945303891540642624154168450",
"86763229579438920770081728504800253983",
"150870013119291395764782044281363112950",
"131326082481914677349735959157043248588",
"24210275322610860831294608585398967446",
"129764113124876494121448885929085973012",
"71486390530081295369239926074438566279",
"20011132473090040996710895076830971085",
"165956794095230296567367962699041212644",
"282491453414060424178357923312445978361",
"319423265386741031860940299712385380851",
"261354174262831775479705088544986958836",
"196162961074247638279565226316989839314",
"267702537261621062426671857582049353792",
"308506649763218082191747494363323030526",
"16930196811355609248584770900754434040",
"79018715050831680274907160204987896941",
"61798564487375343515211503323719066390",
"8580639968140642527782384043375428969",
"35830393958182043156593693776223091415",
"336451580679672529601974901685377748479",
"58948269145660324352845873901198612259",
"167349869267763876242194058871105554534",
"232493852449805322977744262144219817058",
"136611928562438637793484808891225873911",
"163463716588717867416803888762527422205",
"203741174421437103555012285782467699800",
"91579883527652641949973167904651665299",
"106834866243475184027846606331256649036"
],
"threshold": 0.9
},
"id": "CVE-2026-94422-6b2aaf82",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/flatpak/xdg-dbus-proxy/commit/e4465a0dfe96da3b39929a30a1ac3a22b16223e3",
"target": {
"file": "flatpak-proxy.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"161510921744665660011110131505958765919",
"169950437354264837268206341744971402498",
"21253125146561433354054923095803453096",
"229379547655925355036584961254924473813",
"285491442697780022592429720736122878582",
"27158866836501713194621641918615046383",
"101595509793839130390119183374634225647",
"289381548351604397323296302323074572506",
"9383428098537989184172799737545375791",
"80698571986437320140293418531212561256",
"332348436558542724717483435575215664393",
"201461655534259133828988858197031959235",
"105230699018747422717390319955010389697",
"230709243045989922431529580240308076493",
"331271999155406620942816151212804619760",
"331545200724569375085762971668910947873",
"269275105305036851749160008245174890934",
"156771980021063722265761819615052065328",
"174917393057218943205582414619906520633",
"11984688680834104161164307169976420205",
"254718535428122208431232024754615296186",
"77067326260305456034895653182566599750",
"115730607234936392619719305526343660129",
"210017202377675426419243600451875854078",
"220069536832095029360184279935186203410",
"60178695773917764994422458997261993194",
"168962695273515533069748375988865711421",
"213533614998213741965697321194324224984",
"260927693142078964459331661371742950366",
"309870042621213765021603500939918362428",
"90453927810853749735998885187507182635",
"106926624660553613862398748339192343420",
"150893312050162918820883594375184748019",
"41111049813249115237900935908142872574",
"270499705609695720731275858513054984714",
"87873302132317711410697368012881268527",
"329423545619469730157639615111133686908",
"229997718237548964922260735415759494929",
"168784812697584322269191635502236849450",
"95171117406024190483781845030019660400",
"174343192250848999346766289166653183380",
"10713075615237734227420048022423960160",
"218664771391060894725708941959170320310",
"311469948914192732410919998651127354712"
],
"threshold": 0.9
},
"id": "CVE-2026-94422-a0108a9a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/flatpak/xdg-dbus-proxy/commit/e5702fca4dba9600721921fbca2dbc39dc5ca400",
"target": {
"file": "flatpak-proxy.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "236587940773964875336337486251649246506",
"length": 8662
},
"id": "CVE-2026-94422-acdf3ff8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/flatpak/xdg-dbus-proxy/commit/e5702fca4dba9600721921fbca2dbc39dc5ca400",
"target": {
"file": "flatpak-proxy.c",
"function": "parse_header"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "305916020239110511243236716664587885707",
"length": 3615
},
"id": "CVE-2026-94422-c98e2fa8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/flatpak/xdg-dbus-proxy/commit/e4465a0dfe96da3b39929a30a1ac3a22b16223e3",
"target": {
"file": "flatpak-proxy.c",
"function": "got_buffer_from_bus"
}
}
]
vanir_signatures_modified
"2026-10-21T10:52:32Z"