CVE-2026-96807
Received Received - Intake

Flatpak Sandbox Escape via LD Cache Manipulation

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: MITRE

Description
In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this hard to exploit.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-96807
EUVD
EUVD-2026-85423

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
flatpak flatpak to 1.18.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-61 The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-96807 is a vulnerability in Flatpak, a Linux application sandboxing tool. A malicious sandboxed app can replace a specific file with a symlink, causing the system to write files to arbitrary locations outside the sandbox. The filenames and content are fixed, making exploitation difficult but still risky.

Detection Guidance

To detect this vulnerability, check if your Flatpak version is below 1.18.1. Run: flatpak --version. If the output shows a version older than 1.18.1, the system is vulnerable. Additionally, inspect ~/.var/app/$appid/.ld.so for unexpected symlinks.

Impact Analysis

This vulnerability could allow a malicious app to write files to unintended locations on your system, potentially overwriting important files or causing system instability. Since it bypasses sandbox restrictions, it may lead to unauthorized file modifications.

Mitigation Strategies

Update Flatpak to version 1.18.1 or later. For LTS systems, apply the backported fixes in the flatpak-1.16.x branch. Ensure all required libglnx commits are included in the update.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96807. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart