xdg-dbus-proxy CVE-2026-94422

Requires a malicious or compromised application already running inside a sandbox that uses xdg-dbus-proxy before 0.1.9 (Flatpak, or other frameworks such as Firejail). The attack is performed by setting a reply_serial number on non-reply D-Bus messages so the proxy mistakenly treats them as permitted replies, bypassing session-bus message filtering. LIMITING FACTORS: the attacker must first get code running in the sandbox, which typically means the user installs or launches a hostile or already-compromised app (reflected as UI:P); deployments on xdg-dbus-proxy 0.1.9 or later are not affected, and only environments that actually route the session bus through this proxy are exposed.

This is a genuine high-priority sandbox-escape flaw, not a CVSS-inflated paper risk. The provided CVSS 4.0 vector (8.7, AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) rates all three impact dimensions High, consistent with arbitrary code execution outside the sandbox, and CWE-290 (Authentication Bypass by Spoofing) accurately captures the root cause: the proxy trusted reply_serial values and assumed the bus verified them. CONFLICTING SIGNAL: the vector lists AV:N (network), but the actual threat model is a malicious or compromised Flatpak app already executing locally inside the sandbox abusing the local D-Bus session bus - this is effectively local/adjacent code escaping confinement, not a remote-from-the-internet attack. Treat AV:N with caution and verify against the vendor advisory (GHSA-2cgv-pwcq-wvpq). No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; however, the GitHub commit diffs are public, which materially lowers the bar for a skilled attacker to reconstruct a working exploit. The real-world risk is driven less by mass internet exploitation and more by the severity of a confinement bypass in a security boundary that users implicitly trust.

A user installs or runs a Flatpak (or Firejail-confined) application that is malicious or has been compromised. From inside the sandbox the app sends a non-reply D-Bus method call carrying a forged reply_serial that matches a message the proxy believes is an allowed reply, defeating the proxy's filtering and letting the app reach privileged D-Bus services it should not. No public exploit was identified at time of analysis, but the upstream fix commits are published and reveal the exact filtering flaw.