What is CVE-2026-39959?

CVE-2026-39959 is a high-severity vulnerability in Tmds Tmds.dbus, classified under Authentication Bypass by Spoofing. CVSS score: 7.1/10. Published 2026-04-09.

How severe is CVE-2026-39959?

High severity. CVSS v3 base score is 7.1 out of 10.

Resource exhaustion in Tmds Tmds.dbus

CVE-2026-39959

Tmds.DBus provides .NET libraries for working with D-Bus from .NET. Tmds.DBus and Tmds.DBus.Protocol are vulnerable to malicious D-Bus peers. A peer on the same bus can spoof signals by impersonating the owner of a well-known name, exhaust system resources or cause file descriptor spillover by sending messages with an excessive number of Unix file descriptors, and crash the application by sending malformed message bodies that cause unhandled exceptions on the SynchronizationContext. This vulnerability is fixed in Tmds.DBus 0.92.0 and Tmds.DBus.Protocol 0.92.0 and 0.21.3.

EPSS: 0.001 (2.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H.

Affected products

Tmds Tmds.dbus — versions < 0.92.0
Tmds Tmds.dbus.protocol — versions < 0.21.3, >= 0.22.0, < 0.92.0

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-39959?: CVE-2026-39959 is a high-severity vulnerability in Tmds Tmds.dbus, classified under Authentication Bypass by Spoofing. CVSS score: 7.1/10. Published 2026-04-09.
How severe is CVE-2026-39959?: High severity. CVSS v3 base score is 7.1 out of 10.