CVE-2026-39959

HIGH EPSS 2.5%

Published Apr 9, 20262mo ago · Modified Jun 17, 20262w ago

7.1 CVSS 3.1

High

Published Apr 9, 2026 2mo ago

Last Modified Jun 17, 2026 2w ago

Description

Tmds.DBus provides .NET libraries for working with D-Bus from .NET. Tmds.DBus and Tmds.DBus.Protocol are vulnerable to malicious D-Bus peers. A peer on the same bus can spoof signals by impersonating the owner of a well-known name, exhaust system resources or cause file descriptor spillover by sending messages with an excessive number of Unix file descriptors, and crash the application by sending malformed message bodies that cause unhandled exceptions on the SynchronizationContext. This vulnerability is fixed in Tmds.DBus 0.92.0 and Tmds.DBus.Protocol 0.92.0 and 0.21.3.

CVSS Details

Base Score

7.1

Exploitability

1.8

Impact

5.2

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector Local

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality None

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

2.5% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 2

CWE-290

CWE-770

References 1

github.com https://github.com/tmds/Tmds.DBus/security/advisories/GHSA-xrw6-gwf8-vvr9

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.