Dashboard / CVE-2026-16730

CVE-2026-16730

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 36/100
Published: 2026-07-24 Modified: 2026-11-05 First seen: 2026-11-05 Status: active

Attack Surface

Low Complexity No Interaction

CVSS Vector Breakdown

AV: Local
AC: Low
PR: Low
UI: None
S: Unchanged
C: None
I: None
A: High

Description

A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to the desktop session. Flatpak applications can reach the host session bus through the dbus proxy.

Weakness Classification (1)

References & Advisories (6)

https://access.redhat.com/errata/RHSA-2026:61340
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:61355
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:66018
vendor-advisory x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2506348
issue-tracking x_refsource_REDHAT

Bug Bounty Relevance

36 / 100
✓ Low complexity
✓ No user interaction

CVSS Score

5.5 / 10.0 v3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS — Exploitation Probability

0.15%
Raw Score 0.001540
Percentile 4.6%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00154
2026-11-13
0.00154
2026-11-12
0.00154
2026-11-10
0.00154
2026-11-09
0.00154
2026-11-08
0.00154
2026-11-07
0.00154
2026-11-06
0.00154
2026-11-05
0.00154

Intelligence Sources

mitre ref →
nvd ref →

External Links