Is CVE-2026-96807 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96807 being exploited in the wild.

How severe is CVE-2026-96807?

Medium severity, with a CVSS score of 4, published 23 September 2026.

Which products and versions are affected?

Freedesktop.Org Flatpak before 1.18.1.

Is there a fix for CVE-2026-96807?

A patch was published on 2026-08-11: Version 1.18.1 released with fixes; backports available for flatpak-1.16.x LTS branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-96807 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-96807?

Check whether you run Freedesktop.Org Flatpak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96807: Flatpak symlink attack on .ld.so with arbitrary file writes

CVE-2026-96807 · Severity: medium · CVSS 4 · Published 2026-09-23

Flatpak is a containerization technology that isolates applications in sandboxes. A malicious sandboxed application can exploit a symlink vulnerability to write files to arbitrary locations on the system outside its sandbox, potentially compromising system integrity. Although the filenames and file contents are fixed (not attacker-controlled), this could still be leveraged to disable services or degrade system functionality.

Vendors: Freedesktop.Org.

Quick answers

Is CVE-2026-96807 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96807 being exploited in the wild.
How severe is CVE-2026-96807?: Medium severity, with a CVSS score of 4, published 23 September 2026.
Which products and versions are affected?: Freedesktop.Org Flatpak before 1.18.1.
Is there a fix for CVE-2026-96807?: A patch was published on 2026-08-11: Version 1.18.1 released with fixes; backports available for flatpak-1.16.x LTS branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96807 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-96807?: Check whether you run Freedesktop.Org Flatpak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing the regenerate_ld_cache function to follow the symlink and write fixed-content files to arbitrary filesystem locations. This is a Time-of-Check-Time-of-Use (TOCTOU) / symlink attack that bypasses sandbox confinement. The attack requires the app to be running within the Flatpak sandbox to perform the symlink replacement before ld.so regeneration occurs.

Affected products

freedesktop.org Flatpak before 1.18.1

Timeline

2026-08-11: disclosed
2026-08-11: patched: Version 1.18.1 released with fixes; backports available for flatpak-1.16.x LTS branch

References

https://github.com/flatpak/flatpak/security/advisories/GHSA-99wv-m8rp-g58x

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.