CVE-2026-97027

Received Received - Intake

Flatpak Desktop Entry and D-Bus Service Key Injection Vulnerability

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: redhat-SADP

Description

Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.desktop) and D-Bus Service (.service) files, instead of validating against an allowlist. A malicious Flatpak app can use this to cause denial of service (e.g. forced application restart loops) or to influence host D-Bus/systemd activation behavior beyond what the sandbox is intended to permit.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-28

Last Modified

2026-09-28

Generated

2026-09-29

AI Q&A

2026-09-29

EPSS Evaluated

N/A

NVD

CVE-2026-97027

Affected Vendors & Products

Vendor	Product	Version / Range
flatpak	flatpak	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability involves Flatpak passing through arbitrary vendor-extension keys without validation when exporting .desktop and .service files. This allows malicious apps to manipulate system behavior or cause denial of service through forced restart loops.

Detection Guidance

This vulnerability involves Flatpak passing through arbitrary vendor-extension keys without validation. To detect it, inspect Flatpak application .desktop and .service files for unexpected vendor-extension keys. Check logs for forced application restarts or unusual D-Bus/systemd activation behavior. No specific commands are provided in the context.

Impact Analysis

Affected users may experience application instability due to forced restarts or unexpected system behavior influenced by manipulated D-Bus or systemd activation. The sandbox protections may be bypassed, allowing unintended host system interactions.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as described. The issue involves Flatpak passing through arbitrary vendor-extension keys without validation, which could lead to denial of service or unintended system behavior. There is no explicit mention of data exposure or privacy violations that would impact GDPR or HIPAA compliance.

Mitigation Strategies

Update Flatpak to the latest version to ensure vendor-extension keys are properly validated. Review installed Flatpak applications for suspicious .desktop or .service files that include untrusted vendor-extension keys.

Hi! I’m here to help you understand CVE-2026-97027. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70