GNOME malcontent Local Disk Exhaustion via D-Bus API (CVE-2026-44931) Advisory

Vulnerability Overview Vulnerability Name: malcontent: Disk Space Exhaustion via Globally Accessible D-Bus API (CVE-2026-44931) Publication Date: May 11, 2026 Authors: Matthias Gerstner, Filippo Bonazzi (Editor) Tags: CVE, D-BUS Impact Scope Affected Systems: malcontent 0.14.0 in GNOME 50 version updates Vulnerability Type: Local disk space exhaustion attack Attack Vector: Any user can slowly fill up disk space in the system through the newly added D-Bus method Specific Impact: - Creation of numerous entries in the directory - May lead to Denial of Service (DoS) attacks Remediation Temporary Measures: - Restrict method calls to callers within local active sessions - Set an upper limit on usage entries per user account to prevent excessive disk usage Long-term Measures: - An upstream report has been submitted, but due to a lack of developer resources, no bugfix is currently available - CVE-2026-44931 has been assigned to track the issue and raise awareness POC Code Timeline 2026-02-18: Created a private issue in the upstream GitLab repository to coordinate disclosure 2026-03-11: Followed up to check if anyone is monitoring the issue due to lack of response 2026-03-11: Upstream developers responded, confirming the issue and noting limited time availability for malcontent developers 2026-03-23: Inquired about the next steps for coordinating disclosure, explaining that a strict embargo is not mandatory, with a maximum embargo period of 90 days until May 19, 2026 2026-04-09: Urged upstream to make a decision and provide a roadmap in the absence of an answer 2026-04-21: Notified upstream that the report would be published if no response was received by April 30, 2026 2026-05-05: Published a Bugzilla issue describing the problem 2026-05-08: Assigned CVE-2026-44931 and notified upstream 2026-05-11: Released this report References malcontent freedesktop repository malcontent upstream private bug regarding this issue openSUSE review bug for malcontent 0.14.0

Goal Reached Thanks to every supporter — we hit 100%!

GNOME malcontent Local Disk Exhaustion via D-Bus API (CVE-2026-44931) Advisory