# CVE-2026-10037: Canonical Ubuntu OpenJDK sandbox escape via .jar MIME handler

Source: https://junglewise.ai/threats/cve-2026-10037-canonical-ubuntu-openjdk-sandbox-escape-via-jar-mime-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-10037 · Severity: high · CVSS 8.8 · Published 2026-07-08

A security flaw in Ubuntu's OpenJDK packages allows malicious applications restricted within a "sandbox" (like the Firefox Snap) to break out and execute code on the main system. By creating a specially crafted Java file and triggering a system-wide file handler, an attacker can gain full access to the user's files and system resources that should normally be protected. This could lead to complete system compromise if a user runs a malicious sandboxed application.

Vendors: [Canonical](https://junglewise.ai/threats/vendors/canonical).

## Quick answers

**Is CVE-2026-10037 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10037 being exploited in the wild.

**How severe is CVE-2026-10037?** High severity, with a CVSS score of 8.8, published 8 July 2026.

**Which products and versions are affected?** Canonical Mailcap less than 3.70+nmu1ubuntu1.22.04.1, 3.70+nmu1ubuntu1.24.04.1, 3.74ubuntu1.1, 3.75ubuntu1.1.

**Is there a fix for CVE-2026-10037?** A patch was published on 2026-07-08: Fix released in mailcap package via USN-8518-1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-10037 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-10037?** Check whether you run Canonical Mailcap, Canonical OpenJDK 17, Canonical OpenJDK 21 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu due to improper handling of .jar MIME types. The vulnerability is rooted in the interaction between the OpenURI portal (via xdg-desktop-portal-gtk) and the 'cautious-launcher' wrapper provided by the mailcap package. A local attacker or malicious sandboxed application (such as a Snap) can write a malicious .jar file to the host filesystem, set the executable bit, and trigger the MIME handler to execute the file outside the sandbox environment. This occurs because the handler blindly executes files marked as executable when only a single OpenJDK runtime is installed. Canonical has released updated mailcap packages (USN-8518-1) that block the execution of JAR files through this mechanism.

## Affected products

- Canonical Ubuntu openjdk-8, openjdk-11, openjdk-17, openjdk-21, openjdk-25, openjdk-lts
- Canonical mailcap less than 3.70+nmu1ubuntu1.22.04.1, 3.70+nmu1ubuntu1.24.04.1, 3.74ubuntu1.1, 3.75ubuntu1.1

## Timeline

- 2026-05-19: disclosed: Initial bug report by Aaron Rainbolt
- 2026-07-08: patched: Fix released in mailcap package via USN-8518-1
- 2026-07-08: advisory: CVE-2026-10037 published

## References

- [https://bugs.launchpad.net/ubuntu/+source/openjdk-25/+bug/2153100](https://bugs.launchpad.net/ubuntu/+source/openjdk-25/+bug/2153100)