CVE-2026-96807: In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an…

PriorityP419medium4CVSS 3.1

AVLACHPRNUINSUCNILAL

EPSS

0.12%

1.9th percentile

In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this hard to exploit.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
flatpak	flatpak	< 1.18.1	1.18.1
flatpak	flatpak	—	—

CVSS provenance

nvdv3.14.0MEDIUMCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

vendor_redhat4.0MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.