{"id":"CVE-2026-120749","published":"2026-11-06T07:17:06.153","lastModified":"2026-11-06T07:17:10.743","description":"A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon. This is an incomplete fix for CVE-2023-34969, which only assigned serials for driver messages sent to a single recipient. On the well-known system bus this is a denial of service.","cvssScore":6.2,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-617"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-120749","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2567978","tags":[]},{"url":"https://gitlab.freedesktop.org/dbus/dbus/-/merge_requests/565","tags":[]},{"url":"https://gitlab.freedesktop.org/dbus/dbus/-/merge_requests/592","tags":[]},{"url":"https://gitlab.freedesktop.org/dbus/dbus/-/work_items/576","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}