CVE-2026-39959

Tmds.DBus: malicious D-Bus peers can spoof signals, exhaust file descriptor resources, and cause denial of service

State: Published
Severity: 7.1 High
Published: Apr 9, 2026
Updated: Apr 9, 2026
Reserved: Apr 7, 2026

Description

Tmds.DBus provides .NET libraries for working with D-Bus from .NET. Tmds.DBus and Tmds.DBus.Protocol are vulnerable to malicious D-Bus peers. A peer on the same bus can spoof signals by impersonating the owner of a well-known name, exhaust system resources or cause file descriptor spillover by sending messages with an excessive number of Unix file descriptors, and crash the application by sending malformed message bodies that cause unhandled exceptions on the SynchronizationContext. This vulnerability is fixed in Tmds.DBus 0.92.0 and Tmds.DBus.Protocol 0.92.0 and 0.21.3.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H	GitHub_M

Weaknesses

CWE-770 Allocation of Resources Without Limits or Throttling
CWE-290 Authentication Bypass by Spoofing

Affected Products

Product	Versions
Tmds.DBustmds	< 0.92.0Affected
Tmds.DBus.Protocoltmds	< 0.21.3Affected >= 0.22.0, < 0.92.0Affected

References

https://github.com/tmds/Tmds.DBus/security/advisories/GHSA-xrw6-gwf8-vvr9

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.