Message Filtering Vulnerability in xdg-dbus-proxy Affects Flatpak Apps
CVE-2026-94422

8.7HIGH

Key Information:

Vendor

Flatpak

Status
Fedora
Red Hat Enterprise Linux 9
Red Hat Enterprise Linux 10
Vendor
CVE Published:
2 October 2026

What is CVE-2026-94422?

The xdg-dbus-proxy is vulnerable due to an incorrect implementation of message filtering, which allows attackers to manipulate reply serial numbers on non-reply messages. This flaw can potentially enable malicious Flatpak applications to execute arbitrary code outside their designated sandbox. Designed to enhance security boundaries for Flatpak, the xdg-dbus-proxy is sometimes utilized by other application frameworks, increasing its impact on app security when compromised.

References

https://access.redhat.com/security/cve/CVE-2026-94422
vendor-advisory
https://github.com/flatpak/xdg-dbus-proxy/security/adviso...
third-party-advisory
https://github.com/flatpak/xdg-dbus-proxy/commit/e5702fca...
patch

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

refi64
.