OESA-2026-4641: xdg-dbus-proxy security update

Q: Who is most exposed to this issue?

Systems that use xdg-dbus-proxy as part of a sandbox boundary are exposed, particularly Flatpak environments. Other application frameworks that use xdg-dbus-proxy, such as Firejail, can also be affected.

Q: What does an attacker need to exploit the vulnerability?

The attacker needs to cause a malicious or compromised Flatpak application to send crafted D-Bus session-bus messages. The bypass is triggered by setting a reply serial number on messages that are not replies; user interaction is indicated by the severity vector.

Q: What is the impact of successful exploitation?

A malicious or compromised Flatpak app can bypass intended D-Bus message filtering and potentially achieve arbitrary code execution outside its sandbox. This can affect confidentiality, integrity, and availability.

Q: Which versions need to be updated?

xdg-dbus-proxy versions before 0.1.9 are affected. Update to version 0.1.9 or later.

Published Oct 29, 2026

Updated

xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts. Security Fix(es):

An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.(CVE-2026-94422)

Affected Software

1 affected componentFixes available

openeuler/xdg-dbus-proxy<0.1.2-3.oe2403sp1

0.1.2-3.oe2403sp1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/xdg-dbus-proxy to a version that resolves this vulnerability.
Fixed in 0.1.2-3.oe2403sp1
Upgrade
Upgrade xdg-dbus-proxy to a version that resolves this vulnerability.
Fixed in 0.1.9

Event History

Oct 29, 2026

Advisory Published

via OSV·09:03 AM

Data Sourced

via OSV·09:03 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-94422

Frequently Asked Questions

Who is most exposed to this issue?

Systems that use xdg-dbus-proxy as part of a sandbox boundary are exposed, particularly Flatpak environments. Other application frameworks that use xdg-dbus-proxy, such as Firejail, can also be affected.

What does an attacker need to exploit the vulnerability?

The attacker needs to cause a malicious or compromised Flatpak application to send crafted D-Bus session-bus messages. The bypass is triggered by setting a reply serial number on messages that are not replies; user interaction is indicated by the severity vector.

What is the impact of successful exploitation?

A malicious or compromised Flatpak app can bypass intended D-Bus message filtering and potentially achieve arbitrary code execution outside its sandbox. This can affect confidentiality, integrity, and availability.

Which versions need to be updated?

xdg-dbus-proxy versions before 0.1.9 are affected. Update to version 0.1.9 or later.

OESA-2026-4641: xdg-dbus-proxy security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is most exposed to this issue?

What does an attacker need to exploit the vulnerability?

What is the impact of successful exploitation?

Which versions need to be updated?

Company

Resources

Contact

Frequently Asked Questions

Who is most exposed to this issue?

What does an attacker need to exploit the vulnerability?

What is the impact of successful exploitation?

Which versions need to be updated?