CVE-2026-34080
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
xdg-dbus-proxy before version 0.1.7 has a policy parser vulnerability that allows bypassing eavesdrop restrictions. The proxy mishandles cases like 'eavesdrop ='true'' (with a space before the equals sign), enabling clients to intercept D-Bus messages they should not have access to.
Risk Assessment
Attackers can eavesdrop on inter-process communication, potentially gaining access to sensitive data or system functions.
Recommendation
Update xdg-dbus-proxy to version 0.1.7 or later.
Original NVD description (English source)
xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for eavesdrop=true in policy rules but fails to handle eavesdrop ='true' (with a space before the equals sign) and similar cases. Clients can intercept D-Bus messages they should not have access to. This vulnerability is fixed in 0.1.7.