{"id":"CVE-2026-120749","aliases":["AZL-113140","AZL-113266","AZL-113290","DEBIAN-CVE-2026-120749","EUVD-2026-117967","GHSA-r7wg-4x32-8p6v","UBUNTU-CVE-2026-120749"],"status":"published","title":"Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast from the driver cannot be delivered to a monitored bus","description":"A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon.","severity":{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00124,"percentile":0.02193,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-617"],"published":"2026-11-06T00:00:00Z","modified":"2026-11-11T14:17:32Z","affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.15.8-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.75.0-31"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.85.0"},{"last_affected":"1.98.1-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.10-1","1.14.10-1~deb12u1","1.14.10-2","1.14.10-3","1.14.10-4","1.14.10-5","1.14.10-6","1.14.6-1","1.14.8-1","1.14.8-1+loong64","1.14.8-1~deb12u1","1.14.8-2","1.14.8-2~deb12u1","1.14.99~git20220715-1","1.15.0-1","1.15.10-1","1.15.12-1","1.15.2-1","1.15.4-1","1.15.6-1","1.15.6-2","1.15.8-1","1.15.8-2","1.15.8-3","1.15.8-4","1.15.90-1","1.15.92-1","1.16.0-1","1.16.2-1","1.16.2-2","1.16.2-3","1.16.2-4","1.16.2-5","1.16.2-6","1.16.2-7","1.16.2-8"]},{"source":"osv","ecosystem":"Debian:13","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-2","1.16.2-3","1.16.2-4","1.16.2-5","1.16.2-6","1.16.2-7","1.16.2-8"]},{"source":"osv","ecosystem":"Debian:14","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-2","1.16.2-3","1.16.2-4","1.16.2-5","1.16.2-6","1.16.2-7","1.16.2-8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.12-0ubuntu10","1.6.18-0ubuntu1","1.6.18-0ubuntu2","1.6.18-0ubuntu3","1.6.18-0ubuntu4","1.6.18-0ubuntu4.1","1.6.18-0ubuntu4.2","1.6.18-0ubuntu4.3","1.6.18-0ubuntu4.4","1.6.18-0ubuntu4.5","1.6.18-0ubuntu4.5+esm1","1.6.18-0ubuntu4.5+esm2","1.6.18-0ubuntu4.5+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.0-1ubuntu1","1.10.4-1ubuntu2","1.10.6-1ubuntu1","1.10.6-1ubuntu2","1.10.6-1ubuntu3","1.10.6-1ubuntu3.1","1.10.6-1ubuntu3.3","1.10.6-1ubuntu3.4","1.10.6-1ubuntu3.5","1.10.6-1ubuntu3.6","1.10.6-1ubuntu3.6+esm1","1.10.6-1ubuntu3.6+esm2","1.10.6-1ubuntu3.6+esm3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.22-1ubuntu1","1.12.0-1ubuntu1","1.12.2-1ubuntu1","1.12.2-1ubuntu1.1","1.12.2-1ubuntu1.2","1.12.2-1ubuntu1.3","1.12.2-1ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.12.14-1ubuntu2","1.12.16-2ubuntu1","1.12.16-2ubuntu2","1.12.16-2ubuntu2.1","1.12.16-2ubuntu2.2","1.12.16-2ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.12.20-2ubuntu2","1.12.20-2ubuntu3","1.12.20-2ubuntu4","1.12.20-2ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.10-1ubuntu1","1.14.10-3ubuntu1","1.14.10-4ubuntu1","1.14.10-4ubuntu2","1.14.10-4ubuntu3","1.14.10-4ubuntu4","1.14.10-4ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-2ubuntu4","1.16.2-5ubuntu1","1.16.2-5ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-2ubuntu2","1.16.2-2ubuntu3","1.16.2-2ubuntu4"]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-120749","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2567978","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://gitlab.freedesktop.org/dbus/dbus/-/merge_requests/565","tags":["report"]},{"url":"https://gitlab.freedesktop.org/dbus/dbus/-/merge_requests/592","tags":["report"]},{"url":"https://gitlab.freedesktop.org/dbus/dbus/-/work_items/576","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120749","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r7wg-4x32-8p6v"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-120749","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-120749","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-120749","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-120749","title":"Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast from the driver cannot be delivered to a monitored bus","description":"A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon.","status":"published","published":"2026-11-06T06:56:57.944Z","modified":"2026-11-10T04:50:49.366Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-617"],"updated_at":"2026-11-10T03:36:18.859317Z"}],"euvd":[{"id":"EUVD-2026-117967","description":"A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon.","status":"published","published":"2026-11-06T06:56:57Z","modified":"2026-11-10T04:50:49Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-10T03:19:08.417437Z"}],"ghsa":[{"id":"GHSA-r7wg-4x32-8p6v","title":"A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor...","description":"A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon. This is an incomplete fix for CVE-2023-34969, which only assigned serials for driver messages sent to a single recipient. On the well-known system bus this is a denial of service.","status":"published","published":"2026-11-06T09:31:29Z","modified":"2026-11-06T09:31:30Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-617"],"updated_at":"2026-11-06T09:59:37.77326Z"}],"nvd":[{"id":"CVE-2026-120749","description":"A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon.","status":"published","published":"2026-11-06T07:17:06.153Z","modified":"2026-11-10T05:17:58.18Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-617"],"updated_at":"2026-11-10T07:18:23.535277Z"}],"osv":[{"id":"DEBIAN-CVE-2026-120749","description":"A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon.","status":"published","published":"2026-11-06T07:17:06.153Z","modified":"2026-11-10T09:47:43.597475993Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-10T05:22:46.487299Z"},{"id":"UBUNTU-CVE-2026-120749","description":"A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon. This is an incomplete fix for CVE-2023-34969, which only assigned serials for driver messages sent to a single recipient. On the well-known system bus this is a denial of service.","status":"published","published":"2026-11-06T00:00:00Z","modified":"2026-11-07T01:46:13.100520178Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-07T01:56:47.245871Z"},{"id":"AZL-113140","title":"CVE-2026-120749 affecting package dbus 1.15.8-3","description":"A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon.","status":"published","published":"2026-11-06T07:17:06Z","modified":"2026-11-11T14:17:31.925558858Z","updated_at":"2026-11-11T14:42:54.020399Z"},{"id":"AZL-113266","title":"CVE-2026-120749 affecting package rust 1.75.0-31","description":"A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon.","status":"published","published":"2026-11-06T07:17:06Z","modified":"2026-11-11T14:17:32.636639124Z","updated_at":"2026-11-11T14:42:54.020399Z"},{"id":"AZL-113290","title":"CVE-2026-120749 affecting package rust 1.98.1-1","description":"A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon.","status":"published","published":"2026-11-06T07:17:06Z","modified":"2026-11-11T14:17:32.678646209Z","updated_at":"2026-11-11T14:42:54.020399Z"}]}}