The xdg-dbus-proxy service parses policy rules to enforce whether a client may eavesdrop on D-Bus traffic. A flaw in the parser allows a client to supply a value such as "eavesdrop ='true'"—with a space before the equals sign—causing the proxy to incorrectly interpret the flag as true and permit message interception. This can be used by a malicious D-Bus client to observe messages it should not access. The effect is data confidentiality loss within the D-Bus ecosystem.

Flatpak’s xdg-dbus-proxy version 0.1.6 and earlier are affected. The issue is fixed in version 0.1.7 and later; no other products are impacted.

The CVSS score of 6.8 indicates moderate severity, while the EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, implying a low likelihood of exploitation in the wild. The likely attack vector requires local access or a compromised client that can influence policy processing; remote exploitation without additional local privileges is not described. The risk is moderate for environments that rely on strict D-Bus access controls but should still be mitigated promptly.