xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-94422 · Microsoft / collected KEV context

cve-program · CVE-2026-94422

• https://access.redhat.com/security/cve/CVE-2026-94422
• https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-2cgv-pwcq-wvpq
• https://github.com/flatpak/xdg-dbus-proxy/commit/e5702fca4dba9600721921fbca2dbc39dc5ca400
• https://github.com/flatpak/xdg-dbus-proxy/commit/fc027f759316fb2a6c45648200b6f100202eb84e
• https://github.com/flatpak/xdg-dbus-proxy/commit/e4465a0dfe96da3b39929a30a1ac3a22b16223e3
• https://bugzilla.redhat.com/show_bug.cgi?id=2542235

No related operational record is retained in the current change model.