CVE-2026-94422

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-94422
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-94422.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-94422
Aliases
  • GHSA-2cgv-pwcq-wvpq
Downstream
ALPINE (1)
ALSA (2)
AZL (1)
DEBIAN (1)
MGASA (1)
OESA (4)
openSUSE (1)
RLSA (2)
UBUNTU (1)
Related
ALSA (2)
openSUSE (1)
Published
2026-10-02T13:54:10Z
Modified
2026-10-27T21:12:00Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape
Details

An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.

Database specific 
{
    "cna_assigner": "redhat",
    "cwe_ids": [
        "CWE-290"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94422.json"
}
References

Affected packages

Git / github.com/flatpak/xdg-dbus-proxy

Affected ranges

Type
GIT
Repo
https://github.com/flatpak/xdg-dbus-proxy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
72b40c8f6d9d585cfbdb249690724f740d207087
Fixed
e5702fca4dba9600721921fbca2dbc39dc5ca400
Fixed
fc027f759316fb2a6c45648200b6f100202eb84e
Fixed
e4465a0dfe96da3b39929a30a1ac3a22b16223e3
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.1.9"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "e5702fca4dba9600721921fbca2dbc39dc5ca400"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "fc027f759316fb2a6c45648200b6f100202eb84e"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "e4465a0dfe96da3b39929a30a1ac3a22b16223e3"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

0.*
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-94422.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "3872059813419332911623582239146802228",
            "length": 3512
        },
        "id": "CVE-2026-94422-06dfd1c3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/flatpak/xdg-dbus-proxy/commit/e4465a0dfe96da3b39929a30a1ac3a22b16223e3",
        "target": {
            "file": "flatpak-proxy.c",
            "function": "got_buffer_from_client"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "60660592306273335752409373049810668455",
            "length": 3397
        },
        "id": "CVE-2026-94422-073b373a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/flatpak/xdg-dbus-proxy/commit/fc027f759316fb2a6c45648200b6f100202eb84e",
        "target": {
            "file": "flatpak-proxy.c",
            "function": "got_buffer_from_client"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "127539200921787682095583116955048507997",
                "332100610272335632486078497141716361612",
                "6700531888899798426445757426789780200",
                "253611905278887520813879105681107761714",
                "66326802731086662739391650264021877159",
                "203547533127986499755695108548421989642",
                "173878156555487118740790950504304142821",
                "72607511093265852538802829288550278408",
                "255369318311551611832130130115971717103",
                "234950232295825103952543303366657387666",
                "191594920815313139047230507698679405325",
                "89236190513765718229926031721812857634",
                "78885303237091880251844288951396701071",
                "162377607880190927996299896594279274683",
                "153097836638774622698701779208640322125",
                "109499140629255621968514331803138186944",
                "36343974437754435911145033008200848590",
                "291670559291412677953097784851269692437",
                "184195162397993807452449163462755928604",
                "283675478126445828330537920266710601656",
                "56579013132095059668629420333048494362",
                "13066552145364567275314690033476034334",
                "144593429879208132141932007613426188261",
                "72667902760769147735618047765273885700",
                "328858870428537403934819330637353316946",
                "36343974437754435911145033008200848590",
                "214328395007845213153302169550437307346",
                "39590430747443549632029785541588456526",
                "267079884385098371121658411912461171867",
                "189821931812477011723368049963427534914",
                "24973021427930984446979609626331740697",
                "148093249091589822978103547666867178421",
                "273246106891019011842451995302608976776",
                "130103912618840197192245861578698736989",
                "45657012836026740984448469688629785637",
                "226312517612399753459625835971623364194",
                "162367916703401801113327842203873145266",
                "204594058141178765313071205823721300184",
                "105626370749277828957161790917715460871",
                "296204015861468364092617383360127527403",
                "184195162397993807452449163462755928604",
                "333599121106586303863684060248618260025",
                "139183517527597895390710638332151616134",
                "231049018839240130799841593246626134156",
                "320863099075017064562969856814951091332",
                "195171263728043520617484904845240408815",
                "267911668632076480716483795408484684136",
                "65583582638000410667695100867836150706",
                "331396428275677447228085185347963910853",
                "251377243768657292255714155498796626082",
                "172990045900844078287461692870385081999"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-94422-195bf6ae",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/flatpak/xdg-dbus-proxy/commit/fc027f759316fb2a6c45648200b6f100202eb84e",
        "target": {
            "file": "flatpak-proxy.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "102633179866040697155706861877325970424",
            "length": 427
        },
        "id": "CVE-2026-94422-1af46ab5",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/flatpak/xdg-dbus-proxy/commit/e4465a0dfe96da3b39929a30a1ac3a22b16223e3",
        "target": {
            "file": "flatpak-proxy.c",
            "function": "free_side"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "109805863521917563826914666317457881342",
            "length": 3623
        },
        "id": "CVE-2026-94422-3c23b69b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/flatpak/xdg-dbus-proxy/commit/e5702fca4dba9600721921fbca2dbc39dc5ca400",
        "target": {
            "file": "flatpak-proxy.c",
            "function": "got_buffer_from_bus"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "101886033121010108326922321989018429655",
            "length": 2122
        },
        "id": "CVE-2026-94422-46a75169",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/flatpak/xdg-dbus-proxy/commit/e5702fca4dba9600721921fbca2dbc39dc5ca400",
        "target": {
            "file": "flatpak-proxy.c",
            "function": "get_dbus_method_handler"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "158291879281638984542244812521527618739",
            "length": 391
        },
        "id": "CVE-2026-94422-57d6709f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/flatpak/xdg-dbus-proxy/commit/e4465a0dfe96da3b39929a30a1ac3a22b16223e3",
        "target": {
            "file": "flatpak-proxy.c",
            "function": "queue_fake_message"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "127134279361651211749184328543913210960",
                "337486799353005993079489573646304772057",
                "188370337902503540877274226636131733100",
                "232788530928053903451672664124925401104",
                "20610826930346136413136781543501041530",
                "256372287768280859925762222537935802055",
                "131831148393761463044862078459516861069",
                "167920545193598217516369221807918923829",
                "43716606132098059869277431014950608571",
                "24435506950946436315971327874175076740",
                "76922988726776491791234578021032759573",
                "89363628305835631992600715101084592243",
                "324740915974462880594912301158845159366",
                "250512143140547132997268645607772078142",
                "122420013796902016447529928729424789124",
                "145084444892359995733555873394128262477",
                "296606038367697406351597808966371604180",
                "185665542107147573229797442473716272063",
                "71784831984648396085349975423346466610",
                "220451391696150804343505222549306077735",
                "296842231529096182385539091882341646146",
                "218068596799798513206660921407431106305",
                "2488850495567359348374012855065294150",
                "257083081517036389715329790759647213916",
                "301363334093071073893629514873285882441",
                "311403205215382905692904426804922398893",
                "19162300389541745662418892380722088576",
                "204557512399652437300440656857127024013",
                "178726226084795490542905069372383883111",
                "157456838833113935332691732663676201461",
                "271615934527598960329215525392800390899",
                "42854485841203940042158708567484604513",
                "82313991931199953268368926793697885215",
                "106516262384340340970213020798410130183",
                "102469718774798261547189425491015970319",
                "87337221818857857188662322076762909548",
                "127539200921787682095583116955048507997",
                "332100610272335632486078497141716361612",
                "6700531888899798426445757426789780200",
                "1423734045920372675342220950174056211",
                "303094307901699033400137288996938454871",
                "155264034290448809916153048777029780700",
                "217158036059248666479316719600674222494",
                "317538862861971458486719846281640806137",
                "210296538778857963972147768434528907608",
                "325897983471046534238232940279512799342",
                "14148962597212921380753190004792747033",
                "78049841843945303891540642624154168450",
                "86763229579438920770081728504800253983",
                "150870013119291395764782044281363112950",
                "131326082481914677349735959157043248588",
                "24210275322610860831294608585398967446",
                "129764113124876494121448885929085973012",
                "71486390530081295369239926074438566279",
                "20011132473090040996710895076830971085",
                "165956794095230296567367962699041212644",
                "282491453414060424178357923312445978361",
                "319423265386741031860940299712385380851",
                "261354174262831775479705088544986958836",
                "196162961074247638279565226316989839314",
                "267702537261621062426671857582049353792",
                "308506649763218082191747494363323030526",
                "16930196811355609248584770900754434040",
                "79018715050831680274907160204987896941",
                "61798564487375343515211503323719066390",
                "8580639968140642527782384043375428969",
                "35830393958182043156593693776223091415",
                "336451580679672529601974901685377748479",
                "58948269145660324352845873901198612259",
                "167349869267763876242194058871105554534",
                "232493852449805322977744262144219817058",
                "136611928562438637793484808891225873911",
                "163463716588717867416803888762527422205",
                "203741174421437103555012285782467699800",
                "91579883527652641949973167904651665299",
                "106834866243475184027846606331256649036"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-94422-6b2aaf82",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/flatpak/xdg-dbus-proxy/commit/e4465a0dfe96da3b39929a30a1ac3a22b16223e3",
        "target": {
            "file": "flatpak-proxy.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "116595842459042208238043990279124557956",
            "length": 597
        },
        "id": "CVE-2026-94422-707dd990",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/flatpak/xdg-dbus-proxy/commit/e4465a0dfe96da3b39929a30a1ac3a22b16223e3",
        "target": {
            "file": "flatpak-proxy.c",
            "function": "flatpak_proxy_client_init"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "42334481138916073535633900961722314063",
            "length": 3525
        },
        "id": "CVE-2026-94422-97340f16",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/flatpak/xdg-dbus-proxy/commit/fc027f759316fb2a6c45648200b6f100202eb84e",
        "target": {
            "file": "flatpak-proxy.c",
            "function": "got_buffer_from_bus"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "161510921744665660011110131505958765919",
                "169950437354264837268206341744971402498",
                "21253125146561433354054923095803453096",
                "229379547655925355036584961254924473813",
                "285491442697780022592429720736122878582",
                "27158866836501713194621641918615046383",
                "101595509793839130390119183374634225647",
                "289381548351604397323296302323074572506",
                "9383428098537989184172799737545375791",
                "80698571986437320140293418531212561256",
                "332348436558542724717483435575215664393",
                "201461655534259133828988858197031959235",
                "105230699018747422717390319955010389697",
                "230709243045989922431529580240308076493",
                "331271999155406620942816151212804619760",
                "331545200724569375085762971668910947873",
                "269275105305036851749160008245174890934",
                "156771980021063722265761819615052065328",
                "174917393057218943205582414619906520633",
                "11984688680834104161164307169976420205",
                "254718535428122208431232024754615296186",
                "77067326260305456034895653182566599750",
                "115730607234936392619719305526343660129",
                "210017202377675426419243600451875854078",
                "220069536832095029360184279935186203410",
                "60178695773917764994422458997261993194",
                "168962695273515533069748375988865711421",
                "213533614998213741965697321194324224984",
                "260927693142078964459331661371742950366",
                "309870042621213765021603500939918362428",
                "90453927810853749735998885187507182635",
                "106926624660553613862398748339192343420",
                "150893312050162918820883594375184748019",
                "41111049813249115237900935908142872574",
                "270499705609695720731275858513054984714",
                "87873302132317711410697368012881268527",
                "329423545619469730157639615111133686908",
                "229997718237548964922260735415759494929",
                "168784812697584322269191635502236849450",
                "95171117406024190483781845030019660400",
                "174343192250848999346766289166653183380",
                "10713075615237734227420048022423960160",
                "218664771391060894725708941959170320310",
                "311469948914192732410919998651127354712"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-94422-a0108a9a",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/flatpak/xdg-dbus-proxy/commit/e5702fca4dba9600721921fbca2dbc39dc5ca400",
        "target": {
            "file": "flatpak-proxy.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "236587940773964875336337486251649246506",
            "length": 8662
        },
        "id": "CVE-2026-94422-acdf3ff8",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/flatpak/xdg-dbus-proxy/commit/e5702fca4dba9600721921fbca2dbc39dc5ca400",
        "target": {
            "file": "flatpak-proxy.c",
            "function": "parse_header"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "305916020239110511243236716664587885707",
            "length": 3615
        },
        "id": "CVE-2026-94422-c98e2fa8",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/flatpak/xdg-dbus-proxy/commit/e4465a0dfe96da3b39929a30a1ac3a22b16223e3",
        "target": {
            "file": "flatpak-proxy.c",
            "function": "got_buffer_from_bus"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "220103474502960423383573614427162860573",
            "length": 2115
        },
        "id": "CVE-2026-94422-df4a1b6b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/flatpak/xdg-dbus-proxy/commit/e4465a0dfe96da3b39929a30a1ac3a22b16223e3",
        "target": {
            "file": "flatpak-proxy.c",
            "function": "get_dbus_method_handler"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "36156784423409924305234260949207440915",
            "length": 154
        },
        "id": "CVE-2026-94422-dfaf19da",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/flatpak/xdg-dbus-proxy/commit/e4465a0dfe96da3b39929a30a1ac3a22b16223e3",
        "target": {
            "file": "flatpak-proxy.c",
            "function": "queue_expected_reply"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "255037236443082719154949643396270504204",
            "length": 236
        },
        "id": "CVE-2026-94422-e3889cf9",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/flatpak/xdg-dbus-proxy/commit/e4465a0dfe96da3b39929a30a1ac3a22b16223e3",
        "target": {
            "file": "flatpak-proxy.c",
            "function": "steal_expected_reply"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "103222432866939602434359804023807165542",
            "length": 349
        },
        "id": "CVE-2026-94422-ee20ba22",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/flatpak/xdg-dbus-proxy/commit/e4465a0dfe96da3b39929a30a1ac3a22b16223e3",
        "target": {
            "file": "flatpak-proxy.c",
            "function": "init_side"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "339991726338062848112871208321018895697",
            "length": 517
        },
        "id": "CVE-2026-94422-fcca596f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/flatpak/xdg-dbus-proxy/commit/e4465a0dfe96da3b39929a30a1ac3a22b16223e3",
        "target": {
            "file": "flatpak-proxy.c",
            "function": "flatpak_proxy_client_finalize"
        }
    }
]
vanir_signatures_modified 
"2026-10-25T13:01:42Z"