CVE-2026-97027

Published: Sep 28, 2026Modified: Sep 28, 2026

3.6

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L

Exploitability: 1.8 / Impact: 1.4

Source: secalert@redhat.com

Description

Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.desktop) and D-Bus Service (.service) files, instead of validating against an allowlist. A malicious Flatpak app can use this to cause denial of service (e.g. forced application restart loops) or to influence host D-Bus/systemd activation behavior beyond what the sandbox is intended to permit.

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (3)

https://access.redhat.com/security/cve/CVE-2026-97027

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2542683

Source: secalert@redhat.com

https://github.com/flatpak/flatpak/security/advisories/GHSA-v64f-hrwr-j4vh

Source: secalert@redhat.com

Timeline

No history available yet.