CVE-2026-96807: Medium severity Flatpak Flatpak vulnerability
In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerateldcache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this hard to exploit.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
flatpakto a version that resolves this vulnerability.Fixed in 1.18.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running Flatpak versions before 1.18.1 are affected if they run a malicious sandboxed Flatpak application. Exploitation is local; the attack vector is local and does not require privileges or user interaction.
What can an attacker do with this vulnerability?
A malicious sandboxed application can replace its ~/.var/app/$appid/.ld.so path with a symlink and cause regenerate_ld_cache to write files at another location. The filenames and file contents are not attacker-controlled, which makes practical exploitation difficult.
What should be done to remediate the issue?
Upgrade Flatpak to version 1.18.1 or later. The available data does not specify a workaround for systems that cannot yet be updated.