Quick answers
- Is CVE-2026-120749 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-120749 being exploited in the wild.
- How severe is CVE-2026-120749?
- Medium severity, with a CVSS score of 6.2, published 6 November 2026.
- Which products and versions are affected?
- freedesktop D-Bus.
- Is there a fix for CVE-2026-120749?
- No fixed version is recorded yet. This vulnerability can only be exploited when a privileged monitoring process such as dbus-monitor or busctl monitor is actively running on the affected dbus-daemon instance. If no monitoring process is active, the vulnerable code path is not reached. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-120749 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-120749?
- Check whether you run Freedesktop D-Bus. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
This vulnerability can only be exploited when a privileged monitoring process such as dbus-monitor or busctl monitor is actively running on the affected dbus-daemon instance. If no monitoring process is active, the vulnerable code path is not reached.
Technical details
The vulnerability is a reachable assertion (CWE-617) in dbus-daemon triggered when a driver-originated broadcast message cannot be delivered to a monitored recipient. The flaw occurs because driver broadcasts use serial 0; when delivery fails and the daemon attempts to compose a monitor error reply, it asserts reply_serial != 0, causing the daemon to abort. This is an incomplete fix for CVE-2023-34969. The attack requires an unprivileged local user and an active privileged monitoring process on the same bus.
Affected products
- freedesktop D-Bus
Timeline
- 2026-11-06: disclosed