CVE-2026-10037
Fixed in a distro release EPSS <1%CVSS 8.8
A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.
Products: canonical ubuntu
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu 16.04 LTS | openjdk-9 | no fix |
| Ubuntu 20.04 LTS | openjdk-13 | no fix |
| Ubuntu 20.04 LTS | openjdk-16 | no fix |
| Ubuntu 22.04 LTS | mailcap | 3.70+nmu1ubuntu1.22.04.1 |
| Ubuntu 22.04 LTS | openjdk-18 | no fix |
| Ubuntu 24.04 LTS | mailcap | 3.70+nmu1ubuntu1.24.04.1 |
| Ubuntu 25.10 | mailcap | 3.74ubuntu1.1 |
| Ubuntu 26.04 LTS | mailcap | 3.75ubuntu1.1 |
| Ubuntu 26.10 | mailcap | no fix |
| Ubuntu 26.10 | openjdk-17 | no fix |
| Ubuntu 26.10 | openjdk-17-crac | no fix |
| Ubuntu 26.10 | openjdk-21 | no fix |
| Ubuntu 26.10 | openjdk-21-crac | no fix |
| Ubuntu 26.10 | openjdk-8 | no fix |
| Ubuntu 26.10 | openjdk-lts | no fix |