CVE-2026-96807

EUVD-2026-85423
In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this hard to exploit.
Symlink
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mitreCNA
4 MEDIUM
LOCAL
HIGH
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 1.73%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
flatpakflatpak
𝑥
< 1.18.1
CNA
Debian logo
Debian Releases
Debian Product
Codename
flatpak
bookworm
vulnerable
bookworm (security)
vulnerable
forky
1.18.4-1
fixed
sid
1.18.4-1
fixed
trixie
1.16.6-1~deb13u2
fixed
trixie (security)
1.16.6-1~deb13u3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
flatpak
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
stonking
not-affected
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
flatpak
suse enterprise desktop 15 SP7
1.16.6-150600.3.12.1
fixed
suse enterprise sap 12 SP5
1.4.2-3.15.1
fixed
suse enterprise sap 15 SP6
1.16.6-150600.3.12.1
fixed
suse enterprise sap 15 SP7
1.16.6-150600.3.12.1
fixed
suse enterprise server 12 SP5
1.4.2-3.15.1
fixed
suse enterprise server 15 SP6
1.16.6-150600.3.12.1
fixed
suse enterprise server 15 SP7
1.16.6-150600.3.12.1
fixed
flatpak-devel
suse enterprise desktop 15 SP7
1.16.6-150600.3.12.1
fixed
suse enterprise sap 15 SP6
1.16.6-150600.3.12.1
fixed
suse enterprise sap 15 SP7
1.16.6-150600.3.12.1
fixed
suse enterprise server 15 SP6
1.16.6-150600.3.12.1
fixed
suse enterprise server 15 SP7
1.16.6-150600.3.12.1
fixed
flatpak-remote-flathub
suse enterprise desktop 15 SP7
1.16.6-150600.3.12.1
fixed
suse enterprise sap 15 SP6
1.16.6-150600.3.12.1
fixed
suse enterprise sap 15 SP7
1.16.6-150600.3.12.1
fixed
suse enterprise server 15 SP6
1.16.6-150600.3.12.1
fixed
suse enterprise server 15 SP7
1.16.6-150600.3.12.1
fixed
flatpak-zsh-completion
suse enterprise desktop 15 SP7
1.16.6-150600.3.12.1
fixed
suse enterprise sap 15 SP6
1.16.6-150600.3.12.1
fixed
suse enterprise sap 15 SP7
1.16.6-150600.3.12.1
fixed
suse enterprise server 15 SP6
1.16.6-150600.3.12.1
fixed
suse enterprise server 15 SP7
1.16.6-150600.3.12.1
fixed
libflatpak0
suse enterprise desktop 15 SP7
1.16.6-150600.3.12.1
fixed
suse enterprise sap 12 SP5
1.4.2-3.15.1
fixed
suse enterprise sap 15 SP6
1.16.6-150600.3.12.1
fixed
suse enterprise sap 15 SP7
1.16.6-150600.3.12.1
fixed
suse enterprise server 12 SP5
1.4.2-3.15.1
fixed
suse enterprise server 15 SP6
1.16.6-150600.3.12.1
fixed
suse enterprise server 15 SP7
1.16.6-150600.3.12.1
fixed
system-user-flatpak
suse enterprise desktop 15 SP7
1.16.6-150600.3.12.1
fixed
suse enterprise sap 15 SP6
1.16.6-150600.3.12.1
fixed
suse enterprise sap 15 SP7
1.16.6-150600.3.12.1
fixed
suse enterprise server 15 SP6
1.16.6-150600.3.12.1
fixed
suse enterprise server 15 SP7
1.16.6-150600.3.12.1
fixed
typelib-1_0-Flatpak-1_0
suse enterprise desktop 15 SP7
1.16.6-150600.3.12.1
fixed
suse enterprise sap 12 SP5
1.4.2-3.15.1
fixed
suse enterprise sap 15 SP6
1.16.6-150600.3.12.1
fixed
suse enterprise sap 15 SP7
1.16.6-150600.3.12.1
fixed
suse enterprise server 12 SP5
1.4.2-3.15.1
fixed
suse enterprise server 15 SP6
1.16.6-150600.3.12.1
fixed
suse enterprise server 15 SP7
1.16.6-150600.3.12.1
fixed
Common Weakness Enumeration
References
https://github.com/flatpak/flatpak/security/advisories/GHSA-99wv-m8rp-g58x