CVE-2026-94422

This vulnerability is a CWE-290 flaw in xdg-dbus-proxy before version 0.1.9. An attacker can set a reply serial number on non‑reply messages, bypassing the intended filtering on the D‑Bus session bus and thereby enabling a malicious or compromised Flatpak application to execute arbitrary code outside its sandbox. The flaw was originally intended as a sandbox boundary component, but it is sometimes used by other frameworks such as Firejail, widening the potential impact.

The affected product is xdg-dbus-proxy used in Flatpak environments. All deployments running xdg-dbus-proxy before version 0.1.9 are vulnerable. The issue is specific to the message filtering logic implemented in those prior releases. The affected systems include Fedora and Red Hat Enterprise Linux 9 and 10, which ship the vulnerable xdg-dbus-proxy package.

The CVSS score of 8.7 indicates a high severity vulnerability. No EPSS score is available, so the current exploitation likelihood is unknown; however, the vulnerability is listed as not included in the CISA KEV catalog. The likely attack vector is a local attacker running a compromised Flatpak application that can manipulate D‑Bus messages by setting reply serial numbers. If exploited, this flaw grants arbitrary code execution outside the application sandbox, compromising confidentiality, integrity, and availability of the host system.