DEBIAN-CVE-2026-120749

    Dashboard / Vulnerabilities / DEBIAN-CVE-2026-120749

    DEBIAN-CVE-2026-120749

    Published: 6 Nov 2026Last Modified: 7 Nov 2026
    Upstream:
    CVE-2026-120749

    Summary:

    Details: A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon. This is an incomplete fix for CVE-2023-34969, which only assigned serials for driver messages sent to a single recipient. On the well-known system bus this is a denial of service.

    References: https://security-tracker.debian.org/tracker/CVE-2026-120749

    Affected packages

    Package

    Name: dbus

    Purl: pkg:deb/debian/dbus?arch=source&distro=bookworm

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    1.14.10-1
    1.14.10-1~deb12u1
    1.14.10-2
    1.14.10-3
    1.14.10-4
    1.14.10-5
    1.14.10-6
    1.14.6-1
    1.14.8-1
    1.14.8-1+loong64
    1.14.8-1~deb12u1
    1.14.8-2
    1.14.8-2~deb12u1
    1.14.99~git20220715-1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    DEBIAN-CVE-2026-120749 | CVE-DB