CVE-2026-10037: Sandbox Escape in Ubuntu OpenJDK Packages via xdg-desktop-portal
A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/mailcapto a version that resolves this vulnerability.Fixed in 3.70+nmu1ubuntu1.22.04.1 - Upgrade
Upgrade
ubuntu/mailcapto a version that resolves this vulnerability.Fixed in 3.70+nmu1ubuntu1.24.04.1 - Upgrade
Upgrade
ubuntu/mailcapto a version that resolves this vulnerability.Fixed in 3.74ubuntu1.1 - Upgrade
Upgrade
ubuntu/mailcapto a version that resolves this vulnerability.Fixed in 3.75ubuntu1.1 - Configuration
Disable or remove the .jar MIME handler behavior that executes files marked as executable when the mailcap package is installed, to prevent arbitrary code execution via the handler.
Ubuntu mailcap/package MIME handling executable .jar MIME handler execution = disable or remove the handler behavior that executes files marked as executable when the mailcap package is installed - Compensating control
Restrict or prevent sandboxed/malicious applications from accessing the OpenURI portal (xdg-desktop-portal-gtk) so they cannot trigger the MIME handler execution outside the sandbox.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10037?
CVE-2026-10037 has a high severity rating of 8.8.
How do I fix CVE-2026-10037?
You can fix CVE-2026-10037 by updating the OpenJDK packages to the latest version provided by Ubuntu.
What type of vulnerability is CVE-2026-10037?
CVE-2026-10037 is classified as a sandbox escape vulnerability.
What is affected by CVE-2026-10037?
CVE-2026-10037 affects OpenJDK packages provided in Ubuntu.
What can an attacker achieve with CVE-2026-10037?
An attacker can execute files marked as executable from a compromised sandboxed application due to CVE-2026-10037.