{"id":"CVE-2026-44931","aliases":["EUVD-2026-29921","GHSA-9jrh-5pwj-wfmp","UBUNTU-CVE-2026-44931"],"status":"published","title":"malcontent: Disk Space Exhaustion via Globally Accessible D-Bus API","description":"The newly introduced  RecordUsage D-Bus method https://gitlab.freedesktop.org/pwithnall/malcontent/-/blob/0.14.0/libmalcontent-timer/child-timer-service.c  in\nmalcontent-timerd allows arbitrary users in the system to slowly fill up disk space\nin /var/lib/malcontent-timerd","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0015,"percentile":0.04201,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-770"],"published":"2026-05-13T08:30:24Z","modified":"2026-10-26T14:10:00Z","affected":[{"source":"osv","ecosystem":"Ubuntu:26.10","package":"malcontent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.14.0-0ubuntu1","0.14.0-0ubuntu2","0.14.0-0ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"malcontent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13.0-1ubuntu2","0.13.1-1ubuntu1","0.13.1-1ubuntu2","0.13.1-2ubuntu2","0.14~alpha-0ubuntu5","0.14.0-0ubuntu1","0.14.0-0ubuntu1.1","0.14.0-0ubuntu1.2"]}],"products":[{"vendor":"gnome","product":"malcontent"}],"references":[{"url":"https://security.opensuse.org/2026/05/11/malcontent-disk-space-dos.html"},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44931"},{"url":"http://www.openwall.com/lists/oss-security/2026/05/11/1"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44931"},{"url":"https://github.com/advisories/GHSA-9jrh-5pwj-wfmp"},{"url":"https://ubuntu.com/security/CVE-2026-44931","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44931","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/11/1","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-44931","title":"malcontent: Disk Space Exhaustion via Globally Accessible D-Bus API","description":"The newly introduced  RecordUsage D-Bus method https://gitlab.freedesktop.org/pwithnall/malcontent/-/blob/0.14.0/libmalcontent-timer/child-timer-service.c  in\nmalcontent-timerd allows arbitrary users in the system to slowly fill up disk space\nin /var/lib/malcontent-timerd","status":"published","published":"2026-05-13T08:30:24.34Z","modified":"2026-05-13T10:48:50.09Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T13:43:00.288193Z"}],"euvd":[{"id":"EUVD-2026-29921","description":"The newly introduced  RecordUsage D-Bus method https://gitlab.freedesktop.org/pwithnall/malcontent/-/blob/0.14.0/libmalcontent-timer/child-timer-service.c  in\nmalcontent-timerd allows arbitrary users in the system to slowly fill up disk space\nin /var/lib/malcontent-timerd","status":"published","published":"2026-05-13T08:30:24Z","modified":"2026-05-13T10:48:50Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:04:34.274348Z"}],"ghsa":[{"id":"GHSA-9jrh-5pwj-wfmp","title":"The newly introduced  RecordUsage D-Bus method https://gitlab.freedesktop.org/pwithnall...","description":"The newly introduced  RecordUsage D-Bus method https://gitlab.freedesktop.org/pwithnall/malcontent/-/blob/0.14.0/libmalcontent-timer/child-timer-service.c  in\nmalcontent-timerd allows arbitrary users in the system to slowly fill up disk space\nin /var/lib/malcontent-timerd","status":"published","published":"2026-05-13T18:30:52Z","modified":"2026-05-13T18:30:57Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:08:07.151918Z"}],"nvd":[{"id":"CVE-2026-44931","description":"The newly introduced  RecordUsage D-Bus method https://gitlab.freedesktop.org/pwithnall/malcontent/-/blob/0.14.0/libmalcontent-timer/child-timer-service.c  in\nmalcontent-timerd allows arbitrary users in the system to slowly fill up disk space\nin /var/lib/malcontent-timerd","status":"published","published":"2026-05-13T13:01:55.49Z","modified":"2026-10-26T14:10:00.13Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:19.020465Z"}],"osv":[{"id":"UBUNTU-CVE-2026-44931","description":"The newly introduced  RecordUsage D-Bus method https://gitlab.freedesktop.org/pwithnall/malcontent/-/blob/0.14.0/libmalcontent-timer/child-timer-service.c  in malcontent-timerd allows arbitrary users in the system to slowly fill up disk space in /var/lib/malcontent-timerd","status":"published","published":"2026-05-13T13:01:00Z","modified":"2026-10-17T12:58:21.151425105Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:26.396868Z"}]}}