CVE-2026-39959

{
  "id": "CVE-2026-39959",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-09T17:16:30.440",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Tmds.DBus provides .NET libraries for working with D-Bus from .NET. Tmds.DBus and Tmds.DBus.Protocol are vulnerable to malicious D-Bus peers. A peer on the same bus can spoof signals by impersonating the owner of a well-known name, exhaust system resources or cause file descriptor spillover by sending messages with an excessive number of Unix file descriptors, and crash the application by sending malformed message bodies that cause unhandled exceptions on the SynchronizationContext. This vulnerability is fixed in Tmds.DBus 0.92.0 and Tmds.DBus.Protocol 0.92.0 and 0.21.3."
    },
    {
      "lang": "es",
      "value": "Tmds.DBus proporciona bibliotecas .NET para trabajar con D-Bus desde .NET. Tmds.DBus y Tmds.DBus.Protocol son vulnerables a pares D-Bus maliciosos. Un par en el mismo bus puede falsificar señales suplantando la identidad del propietario de un nombre conocido, agotar los recursos del sistema o causar un desbordamiento de descriptores de archivo enviando mensajes con un número excesivo de descriptores de archivo Unix, y bloquear la aplicación enviando cuerpos de mensajes malformados que causan excepciones no controladas en el SynchronizationContext. Esta vulnerabilidad está corregida en Tmds.DBus 0.92.0 y Tmds.DBus.Protocol 0.92.0 y 0.21.3."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "tmds",
          "product": "Tmds.DBus",
          "versions": [
            {
              "version": "< 0.92.0",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "tmds",
          "product": "Tmds.DBus.Protocol",
          "versions": [
            {
              "version": "< 0.21.3",
              "status": "affected"
            },
            {
              "version": ">= 0.22.0, < 0.92.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-09T17:38:26.439943Z",
          "id": "CVE-2026-39959",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-290"
        },
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/tmds/Tmds.DBus/security/advisories/GHSA-xrw6-gwf8-vvr9",
      "source": "[email protected]"
    }
  ]
}