CVE-2026-44931CWE-770

malcontent: Disk Space Exhaustion via Globally Accessible D-Bus API

Medium · published May 13, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
7.0
In the wild
Unconfirmed
What it is

The newly introduced RecordUsage D-Bus method https://gitlab.freedesktop.org/pwithnall/malcontent/-/blob/0.14.0/libmalcontent-timer/child-timer-service.c in

malcontent-timerd allows arbitrary users in the system to slowly fill up disk space

in /var/lib/malcontent-timerd

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00178 · 7.0th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-05-13T08:30Z
EPSS history
Timeline
  • 13 MAY 08:30Z
    malcontent: Disk Space Exhaustion via Globally Accessible D-Bus API
    cvelistv5