The vulnerability resides in the RecordUsage D‑Bus method of malcontent‑timerd, which allows any local user to invoke the API and intentionally consume disk space inside /var/lib/malcontent‑timerd. This resource‑exhaustion flaw can slowly fill the device storage, disabling legitimate operations that require disk writes and potentially causing system malfunctions. The weakness is a classic case of CWE‑770, where uncontrolled allocation of system resources leads to denial of service.

The affected component is the malcontent timer service (malcontent‑timerd) developed for the GNOME ecosystem. The flaw appears in the presented source tree for version 0.14.0 and may affect any later release that incorporates the unguarded RecordUsage method. Exact version details are not enumerated beyond the 0.14.0 code reference, so any distribution that ships this code path is potentially impacted.

The CVSS score of 5.1 reflects a moderate impact, and no EPSS score is available, suggesting a lower likelihood of widespread exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, further indicating low immediate threat. The attack vector is inferred to be local, as any admitted OS user can call the D‑Bus method. An attacker would need to persuade a normal user or take advantage of a local user that runs untrusted code to trigger the disk‑use traffic; no privilege escalation is required.