CVE-2026-94422: An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to

This month

HIGH 8.8

CVE-2026-94422 is a high-severity flaw (CVSS 8.8) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate

Why this priority

High severity

A fixed release or distro patch exists.

Risk facts

CVSS score	8.8 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	Required
EPSS exploit chance	0.7% (top 47%)
CISA exploited list	No
Weakness	CWE-290
Published	2026-10-02
Last modified	2026-10-24

Publisher (CNA): Red Hat, Inc.

Timeline

2026-10-02 14:17 UTCPublished CVE record published
2026-10-24 04:18 UTCUpdated Record last modified

Exact fixes by distribution

Fedora 46 · kwin-zones · FIXED · 1.0.13-1.fc46 · FEDORA-2026-95888f332b · source

sudo dnf upgrade --advisory=FEDORA-2026-95888f332b

Fedora ELN · nginx-mod-brotli · FIXED · 1.0.0~rc-16.eln159 · FEDORA-2026-501a6a8273 · source

sudo dnf upgrade --advisory=FEDORA-2026-501a6a8273

Debian 12 · xdg-dbus-proxy · FIXED · 0.1.4-3+deb12u2

sudo apt update && sudo apt install --only-upgrade xdg-dbus-proxy dpkg --compare-versions "$(dpkg-query -W -f='${Version}' xdg-dbus-proxy)" ge "0.1.4-3+deb12u2" && echo PATCHED || echo STILL-VULNERABLE

Debian 13 · xdg-dbus-proxy · FIXED · 0.1.6-1+deb13u3

sudo apt update && sudo apt install --only-upgrade xdg-dbus-proxy dpkg --compare-versions "$(dpkg-query -W -f='${Version}' xdg-dbus-proxy)" ge "0.1.6-1+deb13u3" && echo PATCHED || echo STILL-VULNERABLE

RHEL 10 · xdg-dbus-proxy · NO FIX YET

RHEL 9 · xdg-dbus-proxy · NO FIX YET

Alpine 3.24 · xdg-dbus-proxy · FIXED · xdg-dbus-proxy-0.1.9-r0

apk add --upgrade xdg-dbus-proxy apk info -v xdg-dbus-proxy

Amazon Linux 2023 · see advisory · FIXED · ALAS2023-2026-3185 · source

sudo dnf update --advisory=ALAS2023-2026-3185

Advisories and coverage

Official advisories

Amazon Linux 2023 ALAS: ALAS2023-2026-3185 (important): xdg-dbus-proxy 2026-10-12

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-94422?

No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.

Is CVE-2026-94422 being exploited?

CVE-2026-94422 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-94422 affect?

CVE-2026-94422 affects affected software. Severity is high (CVSS 8.8). An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A maliciou

How urgent is CVE-2026-94422?

Priority 44/100. High severity

References

← Back to latest CVEs