GHSA-xrw6-gwf8-vvr9
High · 7.1Tmds.DBus: malicious D-Bus peers can spoof signals, exhaust file descriptor resources, and cause denial of service
CVSS
7.1
EPSS
—
Published
Apr 8, 2026
CISA due date
—
The record
Tmds.DBus and Tmds.DBus.Protocol are vulnerable to malicious D-Bus peers. A peer on the same bus can spoof signals by impersonating the owner of a well-known name, exhaust system resources or cause file descriptor spillover by sending messages with an excessive number of Unix file descriptors, and crash the application by sending malformed message bodies that cause unhandled exceptions on the SynchronizationContext.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-39959 Tmds.DBus provides .NET libraries for working with D-Bus from .NET. Same vulnerability
- CVE-2026-113795 pypdf is a free and open-source pure-python PDF library. CWE-400
- CVE-2026-83400 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise… CWE-400
- CVE-2026-112400 Pillow is a Python imaging library. CWE-400
- CVE-2026-111766 markdown-it is a Markdown parser. CWE-400
- CVE-2026-111759 markdown-it is a Markdown parser. CWE-400
- CVE-2025-52290 A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg… CWE-400
- CVE-2026-111066 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. CWE-400