OESA-2026-4570

    Dashboard / Vulnerabilities / OESA-2026-4570

    OESA-2026-4570

    Published: 29 Oct 2026Last Modified: 29 Oct 2026
    Upstream:
    CVE-2026-96807

    Summary: flatpak security update

    Details: flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information. Security Fix(es): In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this hard to exploit.(CVE-2026-96807)

    References: https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4570, https://nvd.nist.gov/vuln/detail/CVE-2026-96807

    Affected packages

    Package

    Name: flatpak

    Purl: pkg:rpm/openEuler/flatpak&distro=openEuler-24.03-LTS-SP1

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.10.2-16.oe2403sp1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    OESA-2026-4570 | CVE-DB