{"id":"DEBIAN-CVE-2026-120749","details":"A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon. This is an incomplete fix for CVE-2023-34969, which only assigned serials for driver messages sent to a single recipient. On the well-known system bus this is a denial of service.","modified":"2026-11-07T23:00:06.733938887Z","published":"2026-11-06T07:17:06.153Z","upstream":["CVE-2026-120749"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-120749"}],"affected":[{"package":{"name":"dbus","ecosystem":"Debian:12","purl":"pkg:deb/debian/dbus?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.10-1","1.14.10-1~deb12u1","1.14.10-2","1.14.10-3","1.14.10-4","1.14.10-5","1.14.10-6","1.14.6-1","1.14.8-1","1.14.8-1+loong64","1.14.8-1~deb12u1","1.14.8-2","1.14.8-2~deb12u1","1.14.99~git20220715-1","1.15.0-1","1.15.10-1","1.15.12-1","1.15.2-1","1.15.4-1","1.15.6-1","1.15.6-2","1.15.8-1","1.15.8-2","1.15.8-3","1.15.8-4","1.15.90-1","1.15.92-1","1.16.0-1","1.16.2-1","1.16.2-2","1.16.2-3","1.16.2-4","1.16.2-5","1.16.2-6","1.16.2-7","1.16.2-8"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-120749.json"}},{"package":{"name":"dbus","ecosystem":"Debian:13","purl":"pkg:deb/debian/dbus?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-2","1.16.2-3","1.16.2-4","1.16.2-5","1.16.2-6","1.16.2-7","1.16.2-8"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-120749.json"}},{"package":{"name":"dbus","ecosystem":"Debian:14","purl":"pkg:deb/debian/dbus?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-2","1.16.2-3","1.16.2-4","1.16.2-5","1.16.2-6","1.16.2-7","1.16.2-8"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-120749.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}