The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xdg-dbus-proxy | Oct 28, 2026 | Oct 27, 2026 |
| Alpine Linux | — | Upgrade xdg-dbus-proxy | Oct 20, 2026 | Oct 2, 2026 |
| Amazon_linux_2023 | — | Upgrade xdg-dbus-proxy-debuginfoUpgrade xdg-dbus-proxyUpgrade xdg-dbus-proxy-debugsource | Oct 13, 2026 | Oct 2, 2026 |
| Debian | — | Upgrade xdg-dbus-proxy | Oct 28, 2026 | Oct 2, 2026 |
| Oracle_linux | — | Upgrade xdg-dbus-proxy | Oct 28, 2026 | Oct 2, 2026 |
| Redhat_linux | — | No solution existsUpgrade xdg-dbus-proxy-debuginfoUpgrade xdg-dbus-proxyUpgrade xdg-dbus-proxy-debugsource | Sep 29, 2026 | Sep 23, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub