# Freedesktop vulnerabilities Source: https://junglewise.ai/threats/vendors/freedesktop Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 10 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/freedesktop.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 15 vulnerabilities in Freedesktop: 1 in the last 7 days and 9 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-120749, was published on 6 November 2026. 4 vulnerabilities in the last four weeks, down 20% on the four before (5). ## Counts - Last 7 days: 1 - Last 30 days: 4 - Last 90 days: 9 - All time: 15 (1 critical, 0 exploited in the wild) ## About Freedesktop Freedesktop is an organization that maintains specifications and standards for interoperability in open-source desktop environments. ## Latest Freedesktop vulnerabilities - [CVE-2026-120749: D-Bus daemon denial of service via monitored broadcast message failure](https://junglewise.ai/threats/cve-2026-120749-a-flaw-was-found-in-d-bus-with-a-privileged-monitoring-client) (medium, CVSS 6.2, published 6 Nov 2026) - [CVE-2026-120830: libslirp out-of-bounds heap read in icmp_forward_error()](https://junglewise.ai/threats/cve-2026-120830-a-flaw-was-found-in-libslirp-in-icmp-forward-error-when-building) (high, CVSS 7.4, published 3 Nov 2026) - [CVE-2026-109088: libXtst infinite loop in RECORD EnableContext reply parsing](https://junglewise.ai/threats/cve-2026-109088-a-malicious-x-server-could-send-malformed-record-enablecontext) (medium, CVSS 6.5, published 27 Oct 2026) - [CVE-2026-112271: libdisplay-info heap out-of-bounds read in DisplayID parser](https://junglewise.ai/threats/cve-2026-112271-libdisplay-info-through-0-4-0-contains-a-heap-out-of-bounds-read) (medium, CVSS 5.5, published 19 Oct 2026) - [CVE-2026-107705: Poppler stack-based buffer overflow in Decrypt::revision6Hash()](https://junglewise.ai/threats/cve-2026-107705-poppler-0-42-0-through-26-10-0-contains-a-stack-based-buffer) (medium, CVSS 6.5, published 8 Oct 2026) - [CVE-2026-94287: libXpm unsigned integer underflow in write path](https://junglewise.ai/threats/cve-2026-94287-a-denial-of-service-via-unsigned-underflow-in-libxpm-s-write-path) (medium, CVSS 5.5, published 28 Sep 2026) - [CVE-2026-94286: libXtst out-of-bounds read in RECORD reply parser](https://junglewise.ai/threats/cve-2026-94286-an-out-of-bounds-read-in-libxtst-s-record-reply-parser-in-libxtst) (high, CVSS 7.1, published 28 Sep 2026) - [CVE-2026-94282: libXi out-of-bounds read in XI2 enter/leave/focus event parsing](https://junglewise.ai/threats/cve-2026-94282-an-out-of-bounds-read-in-libxi-s-xi2-enter-leave-focus-cookie) (medium, CVSS 5.6, published 28 Sep 2026) - [CVE-2026-96808: Flatpak revokefs symlink path traversal privilege escalation](https://junglewise.ai/threats/cve-2026-96808-in-flatpak-before-1-18-1-the-revokefs-writer-used-by-the-flatpak) (high, CVSS 7.4, published 23 Sep 2026) - [CVE-2026-35094: A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can…](https://junglewise.ai/threats/cve-2026-35094-a-flaw-was-found-in-libinput-an-attacker-capable-of-deploying-a) (low, CVSS 3.3, published 1 Apr 2026) - [CVE-2026-4897: A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to…](https://junglewise.ai/threats/cve-2026-4897-a-flaw-was-found-in-polkit-a-local-user-can-exploit-this-by) (medium, CVSS 5.5, published 26 Mar 2026) - [CVE-2026-1940: An incomplete fix for allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation c](https://junglewise.ai/threats/cve-2026-1940-an-incomplete-fix-for-allows-an-out-of-bounds-read-in-gst-wavparse) (medium, CVSS 5.1, published 23 Mar 2026) - [CVE-2026-26104: A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption…](https://junglewise.ai/threats/cve-2026-26104-a-flaw-was-found-in-the-udisks-storage-management-daemon-that) (medium, CVSS 5.5, published 25 Feb 2026) - [CVE-2026-26103: udisks missing authorization in LUKS header restoration API](https://junglewise.ai/threats/cve-2026-26103-udisks-missing-authorization-in-luks-header-restoration-api) (high, CVSS 7.1, published 25 Feb 2026) - [CVE-2016-2090: freedesktop libbsd heap buffer overflow in fgetwln](https://junglewise.ai/threats/cve-2016-2090-freedesktop-libbsd-heap-buffer-overflow-in-fgetwln) (critical, CVSS 9.8, published 13 Jan 2017) ## Most severe Freedesktop vulnerabilities - [CVE-2016-2090: freedesktop libbsd heap buffer overflow in fgetwln](https://junglewise.ai/threats/cve-2016-2090-freedesktop-libbsd-heap-buffer-overflow-in-fgetwln) (critical, CVSS 9.8, published 13 Jan 2017) - [CVE-2026-96808: Flatpak revokefs symlink path traversal privilege escalation](https://junglewise.ai/threats/cve-2026-96808-in-flatpak-before-1-18-1-the-revokefs-writer-used-by-the-flatpak) (high, CVSS 7.4, published 23 Sep 2026) - [CVE-2026-120830: libslirp out-of-bounds heap read in icmp_forward_error()](https://junglewise.ai/threats/cve-2026-120830-a-flaw-was-found-in-libslirp-in-icmp-forward-error-when-building) (high, CVSS 7.4, published 3 Nov 2026) - [CVE-2026-26103: udisks missing authorization in LUKS header restoration API](https://junglewise.ai/threats/cve-2026-26103-udisks-missing-authorization-in-luks-header-restoration-api) (high, CVSS 7.1, published 25 Feb 2026) - [CVE-2026-94286: libXtst out-of-bounds read in RECORD reply parser](https://junglewise.ai/threats/cve-2026-94286-an-out-of-bounds-read-in-libxtst-s-record-reply-parser-in-libxtst) (high, CVSS 7.1, published 28 Sep 2026) - [CVE-2026-107705: Poppler stack-based buffer overflow in Decrypt::revision6Hash()](https://junglewise.ai/threats/cve-2026-107705-poppler-0-42-0-through-26-10-0-contains-a-stack-based-buffer) (medium, CVSS 6.5, published 8 Oct 2026) - [CVE-2026-109088: libXtst infinite loop in RECORD EnableContext reply parsing](https://junglewise.ai/threats/cve-2026-109088-a-malicious-x-server-could-send-malformed-record-enablecontext) (medium, CVSS 6.5, published 27 Oct 2026) - [CVE-2026-120749: D-Bus daemon denial of service via monitored broadcast message failure](https://junglewise.ai/threats/cve-2026-120749-a-flaw-was-found-in-d-bus-with-a-privileged-monitoring-client) (medium, CVSS 6.2, published 6 Nov 2026) - [CVE-2026-94282: libXi out-of-bounds read in XI2 enter/leave/focus event parsing](https://junglewise.ai/threats/cve-2026-94282-an-out-of-bounds-read-in-libxi-s-xi2-enter-leave-focus-cookie) (medium, CVSS 5.6, published 28 Sep 2026) - [CVE-2026-4897: A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to…](https://junglewise.ai/threats/cve-2026-4897-a-flaw-was-found-in-polkit-a-local-user-can-exploit-this-by) (medium, CVSS 5.5, published 26 Mar 2026) ## Vulnerabilities per week 4 vulnerabilities in the last four weeks, down 20% on the four before (5). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 3 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 2 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Freedesktop vulnerabilities", https://junglewise.ai/threats/vendors/freedesktop, 10 November 2026.