There are 4 open security issues in trixie.
4 issues left for the package maintainer to handle:
- CVE-2026-120749:
(needs triaging)
A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon.
- CVE-2026-128987:
(needs triaging)
- TEMP-1153843-36094F:
(needs triaging)
- TEMP-1153844-83400A:
(needs triaging)
You can find information about how to handle these issues in the security team's documentation.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/d/dbus.png){kind=link}