OESA-2026-4570: flatpak security update

Q: Who is exposed to this issue?

Systems running Flatpak before 1.18.1 are affected. Exploitation requires a malicious application already running inside the Flatpak sandbox.

Q: What access does an attacker need?

The attacker does not need prior privileges or user interaction, but must be able to run a malicious sandboxed Flatpak application. The issue relies on replacing the application's .ld.so path with a symlink.

Q: How practical is exploitation?

The advisory describes exploitation as hard because the attacker cannot control the filenames or content written by regenerate_ld_cache. The potential impact is integrity and availability loss, not confidentiality loss.

Q: What should be done if the update cannot be applied immediately?

The provided information does not list a workaround. Until Flatpak is updated to 1.18.1 or later, avoid running untrusted Flatpak applications.

Published Oct 29, 2026

Updated

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information. Security Fix(es):

In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerateldcache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this hard to exploit.(CVE-2026-96807)

Affected Software

1 affected componentFixes available

openeuler/flatpak<1.10.2-16.oe2403sp1

1.10.2-16.oe2403sp1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/flatpak to a version that resolves this vulnerability.
Fixed in 1.10.2-16.oe2403sp1
Upgrade
Upgrade flatpak to a version that resolves this vulnerability.
Fixed in 1.18.1

Event History

Oct 29, 2026

Advisory Published

via OSV·09:03 AM

Data Sourced

via OSV·09:03 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-96807

Frequently Asked Questions

Who is exposed to this issue?

Systems running Flatpak before 1.18.1 are affected. Exploitation requires a malicious application already running inside the Flatpak sandbox.

What access does an attacker need?

The attacker does not need prior privileges or user interaction, but must be able to run a malicious sandboxed Flatpak application. The issue relies on replacing the application's .ld.so path with a symlink.

How practical is exploitation?

The advisory describes exploitation as hard because the attacker cannot control the filenames or content written by regenerate_ld_cache. The potential impact is integrity and availability loss, not confidentiality loss.

What should be done if the update cannot be applied immediately?

The provided information does not list a workaround. Until Flatpak is updated to 1.18.1 or later, avoid running untrusted Flatpak applications.

OESA-2026-4570: flatpak security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is exposed to this issue?

What access does an attacker need?

How practical is exploitation?

What should be done if the update cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What access does an attacker need?

How practical is exploitation?

What should be done if the update cannot be applied immediately?