CVE-2026-96807
Fixed in a distro release EPSS <1%CVSS 4.0
In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this hard to exploit.
Products: flatpak
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | flatpak | no fix |
| Debian 13 | flatpak | 1.16.6-1~deb13u2 |
| Debian 14 | flatpak | 1.18.1-1 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | flatpak | 1.4.2-3.15.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | flatpak | 1.4.2-3.15.1 |
| Ubuntu 26.04 LTS | flatpak | no fix |
| Ubuntu Pro 18.04 LTS | flatpak | no fix |
| Ubuntu Pro 20.04 LTS | flatpak | no fix |
| Ubuntu Pro 22.04 LTS | flatpak | no fix |
| Ubuntu Pro 24.04 LTS | flatpak | no fix |