CVE-2026-10037
published 2026-07-08CVE-2026-10037: A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as…
PriorityP349high8.8CVSS 3.1
AVLACLPRLUINSCCHIHAH
EPSS
0.18%
7.1th percentile
A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu | < 3.70+nmu1ubuntu1.22.04.1 | 3.70+nmu1ubuntu1.22.04.1 |
| canonical | ubuntu | < 3.70+nmu1ubuntu1.24.04.1 | 3.70+nmu1ubuntu1.24.04.1 |
| canonical | ubuntu | < 3.74ubuntu1.1 | 3.74ubuntu1.1 |
| canonical | ubuntu | < 3.75ubuntu1.1 | 3.75ubuntu1.1 |
| ubuntu | mailcap | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
openjdk: OpenJDK: Sandbox escape allows arbitrary code execution
vendor_redhat·2026-07-08·CVSS 8.8
CVE-2026-10037 [HIGH] CWE-427 openjdk: OpenJDK: Sandbox escape allows arbitrary code execution
openjdk: OpenJDK: Sandbox escape allows arbitrary code execution
A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.
A flaw was found in OpenJDK. A local attacker with low privileges can exploit a sandbox escape vulnerability in the OpenJDK packages. This occurs because the .jar MIME handlers, when the mailcap package is installed, execute files marked as executab
Ubuntu
mailcap vulnerability
vendor_ubuntu·2026-07-08
CVE-2026-10037 mailcap vulnerability
Title: mailcap vulnerability
Summary: mailcap could allow applications to escape sandbox restrictions
Aaron Rainbolt discovered that the cautious-launcher utility in the
mailcap package did not properly restrict the execution of certain
file types. An attacker could use this issue to escape a sandboxed
application and execute arbitrary code on the host operating system.
Instructions: In general, a standard system update will make all the necessary changes.
VulDB
Canonical Ubuntu up to 3.74ubuntu1.0/3.75ubuntu1.0 MIME input validation
vuldb·2026-07-09·CVSS 8.8
CVE-2026-10037 [HIGH] Canonical Ubuntu up to 3.74ubuntu1.0/3.75ubuntu1.0 MIME input validation
A vulnerability has been found in Canonical Ubuntu up to 3.74ubuntu1.0/3.75ubuntu1.0 and classified as problematic. Affected by this issue is some unknown functionality of the component MIME Handler. Performing a manipulation results in improper input validation.
This vulnerability is reported as CVE-2026-10037. The attack requires a local approach. No exploit exists.
GHSA
A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu.
ghsa_unreviewed·2026-07-09
CVE-2026-10037 [HIGH] CWE-20 A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu.
A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.
No detection rules found.
No public exploits indexed.
2026-07-08
Published