The vulnerability in Tmds.DBus and Tmds.DBus.Protocol allows a malicious peer on the same D-Bus to spoof signals by impersonating the owner of a well-known name, exhaust system resources or cause file descriptor spillover by sending messages with excessive Unix file descriptors, and crash the application by sending malformed message bodies that trigger unhandled exceptions on the SynchronizationContext. This is due to lack of limits or throttling on resource allocation and insufficient authentication controls. The issue affects versions prior to 0.92.0 for Tmds.DBus and prior to 0.21.3 for Tmds.DBus.Protocol. The vulnerability is fixed in the specified versions.

An attacker with access to the same D-Bus can cause denial of service by exhausting system resources or crashing the application. They can also spoof signals by impersonating legitimate bus name owners, potentially disrupting application logic or causing incorrect behavior. There is no direct confidentiality impact reported. The vulnerability has a CVSS v3.1 score of 7.1 (high), reflecting high impact on integrity and availability but no impact on confidentiality.

Upgrade Tmds.DBus to version 0.92.0 or later and Tmds.DBus.Protocol to version 0.92.0 or 0.21.3 or later to apply the official fix. No other mitigation guidance is provided. Patch status is confirmed by the vendor advisory embedded in the CVE description.