CVE-2026-48831: High severity Wine Wine vulnerability
Wine ships a .desktop file that registers itself as a MIME handler for EXE files and several other Windows executable file types. In some configurations, handling of an EXE file causes that file to be blindly executed with the permissions of the invoker. This allows escaping Flatpak and Snap sandboxes, because MIME handlers are not intended for use by code interpreters and loaders. NOTE: some parties feel that this is not a bug to be addressed in Wine, because there is no known solution that avoids a severe loss of usability (Wine could be a binfmt-misc handler, but binfmt-misc does not exist on all platforms supported by Wine).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Wine .desktop MIME handler for EXE files (and other Windows executable file types)from your environment.Remove/disable Wine’s provided .desktop entry that registers Wine as a MIME handler for EXE files (and the other listed Windows executable file types) so EXE handling cannot trigger blindly executed Wine code with the invoker’s permissions.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48831?
The severity of CVE-2026-48831 is rated as high with a CVSS score of 7.3.
How do I fix CVE-2026-48831?
To fix CVE-2026-48831, ensure that the handling of EXE files through Wine does not allow execution of files with elevated permissions.
What impact does CVE-2026-48831 have on system security?
CVE-2026-48831 can lead to unauthorized execution of Windows executable files, bypassing Flatpak and Snap sandbox protections.
Is CVE-2026-48831 relevant to all Wine users?
Yes, CVE-2026-48831 affects all Wine users who handle EXE files and may lead to security vulnerabilities.
Can CVE-2026-48831 be exploited remotely?
CVE-2026-48831 is not primarily a remote exploit but relies on the invoker's actions to execute a malicious EXE file.