PT-2026-31658 · Tmds.Dbus+1 · Tmds.Dbus+1

Published 2026-04-08 · Updated 2026-04-09 · CVE-2026-39959

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tmds.DBus versions prior to 0.92.0 Tmds.DBus.Protocol versions prior to 0.92.0 and 0.21.3

Description Tmds.DBus and Tmds.DBus.Protocol are susceptible to attacks from malicious D-Bus peers. An attacker on the same bus can impersonate the owner of a well-known name to spoof signals, exhaust system resources or cause file descriptor spillover by sending messages containing an excessive number of Unix file descriptors, and crash the application by sending malformed message bodies that trigger unhandled exceptions on the SynchronizationContext.

Recommendations Upgrade Tmds.DBus to version 0.92.0 or later. Upgrade Tmds.DBus.Protocol to version 0.92.0 or 0.21.3 or later.

Fix

Allocation of Resources Without Limits

Resource Exhaustion

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-770

CWE-400

CWE-290

Related Identifiers

CVE-2026-39959

GHSA-XRW6-GWF8-VVR9

Affected Products

Tmds.Dbus

Tmds.Dbus.Protocol

References · 7

• https://osv.dev/vulnerability/GHSA-xrw6-gwf8-vvr9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39959 · Security Note
• https://github.com/tmds/Tmds.DBus/releases/tag/rel%2F0.92.0 · Note
• https://github.com/tmds/Tmds.DBus/releases/tag/rel%2F0.21.3 · Note
• https://github.com/tmds/Tmds.DBus · Note
• https://github.com/tmds/Tmds.DBus/security/advisories/GHSA-xrw6-gwf8-vvr9 · Note
• https://twitter.com/CVEnew/status/2042302794703757569 · Twitter Post