CVE catalog

CVE-2026-55889

xdg-desktop-portal: CVE-2026-55889

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.34% · Oct 25, 2026

XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data targeted at other applications to itself. Some portals generate tokens which provide access to resources. The sharing of the token transfers access to the resource and is supposed to happen out of band. The tokens were generated with g_random_int or g_uuid_string_random, both of which use GLib's GRand based on the Mersenne Twister PRNG which created a stream of reproducible random numbers. By generating enough tokens, the state of the GRand can be recover and with it, the next tokens can be predictedinsufin. This issue has been patched in version 1.22.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianxdg-desktop-portalsid1.22.1+ds-1fixed
Debianxdg-desktop-portalforky1.22.1+ds-1fixed
Debianxdg-desktop-portaltrixie1.20.3+ds-1vulnerable
Debianxdg-desktop-portalbookworm1.16.0-2vulnerable
Ubuntuxdg-desktop-portal16.041.0.3-0ubuntu0.0vulnerable
Ubuntuxdg-desktop-portal18.040.8-2vulnerable
Ubuntuxdg-desktop-portal18.040.8-3vulnerable
Ubuntuxdg-desktop-portal18.040.9-1vulnerable
Ubuntuxdg-desktop-portal18.040.9-2vulnerable
Ubuntuxdg-desktop-portal18.040.10-0ubuntu1vulnerable
Ubuntuxdg-desktop-portal18.040.10-2vulnerable
Ubuntuxdg-desktop-portal18.040.10-4vulnerable
Ubuntuxdg-desktop-portal18.040.11-1vulnerable
Ubuntuxdg-desktop-portal18.041.0.3-0ubuntu0.2vulnerable
Ubuntuxdg-desktop-portal20.041.4.2-2vulnerable
Ubuntuxdg-desktop-portal20.041.4.2-3vulnerable
Ubuntuxdg-desktop-portal20.041.6.0-1vulnerable
Ubuntuxdg-desktop-portal20.041.6.0-1ubuntu1vulnerable
Ubuntuxdg-desktop-portal20.041.6.0-1ubuntu2vulnerable
Ubuntuxdg-desktop-portal22.041.8.1-1build1vulnerable
Ubuntuxdg-desktop-portal22.041.10.1-2vulnerable
Ubuntuxdg-desktop-portal22.041.10.1-4vulnerable
Ubuntuxdg-desktop-portal22.041.12.1-1vulnerable
Ubuntuxdg-desktop-portal22.041.12.1-1build1vulnerable
Ubuntuxdg-desktop-portal22.041.12.1-1ubuntu1vulnerable
Ubuntuxdg-desktop-portal22.041.14.1-1vulnerable
Ubuntuxdg-desktop-portal22.041.14.1-2vulnerable
Ubuntuxdg-desktop-portal22.041.14.2-1vulnerable
Ubuntuxdg-desktop-portal22.041.14.2-1ubuntu1vulnerable
Ubuntuxdg-desktop-portal22.041.14.2-1ubuntu2vulnerable
Ubuntuxdg-desktop-portal22.041.14.3-0ubuntu2vulnerable
Ubuntuxdg-desktop-portal22.041.14.3-0ubuntu2.22.04.1vulnerable
Ubuntuxdg-desktop-portal22.041.14.4-1ubuntu1~22.04.1vulnerable
Ubuntuxdg-desktop-portal22.041.14.4-1ubuntu2~22.04.1vulnerable
Ubuntuxdg-desktop-portal22.041.14.4-1ubuntu2~22.04.2vulnerable
Ubuntuxdg-desktop-portal24.041.18.0-1ubuntu1vulnerable
Ubuntuxdg-desktop-portal24.041.18.2-1ubuntu1vulnerable
Ubuntuxdg-desktop-portal24.041.18.2-1ubuntu3vulnerable
Ubuntuxdg-desktop-portal24.041.18.2-1ubuntu4vulnerable
Ubuntuxdg-desktop-portal24.041.18.3-1ubuntu1vulnerable
Ubuntuxdg-desktop-portal24.041.18.4-1ubuntu2vulnerable
Ubuntuxdg-desktop-portal24.041.18.4-1ubuntu2.24.04.1vulnerable
Ubuntuxdg-desktop-portal24.041.18.4-1ubuntu2.24.04.2vulnerable
Ubuntuxdg-desktop-portal24.041.18.4-1ubuntu2.24.04.3vulnerable
Ubuntuxdg-desktop-portal26.101.21.1+ds-1ubuntu3vulnerable
Ubuntuxdg-desktop-portal26.101.21.1+ds-1ubuntu4vulnerable
Ubuntuxdg-desktop-portal26.101.21.1+ds-1ubuntu5vulnerable
Ubuntuxdg-desktop-portal26.101.21.1+ds-1ubuntu6vulnerable
Ubuntuxdg-desktop-portal26.041.20.3+ds-1ubuntu1vulnerable
Ubuntuxdg-desktop-portal26.041.20.3+ds-1ubuntu2vulnerable
Ubuntuxdg-desktop-portal26.041.21.0+ds-1ubuntu3vulnerable
Ubuntuxdg-desktop-portal26.041.21.0+ds-1ubuntu4vulnerable
Ubuntuxdg-desktop-portal26.041.21.0+ds-1ubuntu6vulnerable
Ubuntuxdg-desktop-portal26.041.21.0+ds-1ubuntu7vulnerable
Ubuntuxdg-desktop-portal26.041.21.0+ds-1ubuntu8vulnerable
Ubuntuxdg-desktop-portal26.041.21.1+ds-1ubuntu1vulnerable
Ubuntuxdg-desktop-portal26.041.21.1+ds-1ubuntu2vulnerable
Ubuntuxdg-desktop-portal26.041.21.1+ds-1ubuntu3vulnerable
Ubuntuxdg-desktop-portal26.041.21.1+ds-1ubuntu3.1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianxdg-desktop-portalsourcesid1.22.1+ds-1not yet assignedNot reportedNot reported
Debianxdg-desktop-portalsourceforky1.22.1+ds-1not yet assignedNot reportedNot reported
Debianxdg-desktop-portalsourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianxdg-desktop-portalsourcebookworm(unfixed)not yet assignedNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [xdg-desktop-portal]Affected
    Details (2)

    • 1.16.0-2 · amd64 · bookworm

      Affected

      dsa · xdg-desktop-portal · debian · bookworm; dsa · xdg-desktop-portal · debian · 12

    • 1.16.0-2 · arm64 · bookworm

      Affected

      dsa · xdg-desktop-portal · debian · bookworm; dsa · xdg-desktop-portal · debian · 12

  • [xdg-desktop-portal-dev]Affected

    Source package: [xdg-desktop-portal]

    Details (2)

    • 1.16.0-2 · all · bookworm

      Affected

      dsa · xdg-desktop-portal · debian · bookworm; dsa · xdg-desktop-portal · debian · 12

    • 1.16.0-2 · all · bookworm

      Affected

      dsa · xdg-desktop-portal · debian · bookworm; dsa · xdg-desktop-portal · debian · 12

  • [xdg-desktop-portal-tests]Affected

    Source package: [xdg-desktop-portal]

    Details (2)

    • 1.16.0-2 · amd64 · bookworm

      Affected

      dsa · xdg-desktop-portal · debian · bookworm; dsa · xdg-desktop-portal · debian · 12

    • 1.16.0-2 · arm64 · bookworm

      Affected

      dsa · xdg-desktop-portal · debian · bookworm; dsa · xdg-desktop-portal · debian · 12

[Debian 13 (Trixie)]

  • [xdg-desktop-portal]Affected
    Details (2)

    • 1.20.3+ds-1 · amd64 · trixie

      Affected

      dsa · xdg-desktop-portal · debian · 13

    • 1.20.3+ds-1 · arm64 · trixie

      Affected

      dsa · xdg-desktop-portal · debian · 13

  • [xdg-desktop-portal-dev]Affected

    Source package: [xdg-desktop-portal]

    Details (2)

    • 1.20.3+ds-1 · all · trixie

      Affected

      dsa · xdg-desktop-portal · debian · 13

    • 1.20.3+ds-1 · all · trixie

      Affected

      dsa · xdg-desktop-portal · debian · 13

  • [xdg-desktop-portal-tests]Affected

    Source package: [xdg-desktop-portal]

    Details (2)

    • 1.20.3+ds-1 · amd64 · trixie

      Affected

      dsa · xdg-desktop-portal · debian · 13

    • 1.20.3+ds-1 · arm64 · trixie

      Affected

      dsa · xdg-desktop-portal · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]