Critical Security Flaws in Flatpak: Arbitrary Code Execution and Privilege Escalation
Summary
ALSA-2026:80497: Important: flatpak security update. Affects flatpak versions < 1.12.9-4.el9_8.4. Fixed in 1.12.9-4.el9_8.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flatpak is a powerful system designed for building, distributing, and running sandboxed desktop applications on Linux. It allows developers to package their applications with all necessary dependencies, ensuring consistent behavior across different Linux distributions. However, recent vulnerabilities have been identified that could compromise the security of applications running within this framework, exposing users to potential risks.
Vulnerability Detail
The vulnerabilities in Flatpak include arbitrary code execution due to missing symlink protection (CVE-2026-90616), arbitrary write access as root through extra-data extraction (CVE-2026-96275), a buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280), and local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808). These vulnerabilities can lead to unauthorized access, data corruption, and system compromise, making it crucial for users to address them promptly.
How To Fix
Minimum fixed version
1.12.9-4.el9_8.4
This is the first release that contains the fix.
sudo dnf update flatpakTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the permissions of Flatpak applications and avoid running untrusted applications until the update is applied. Additionally, users can monitor their systems for any unusual activity that may indicate exploitation of these vulnerabilities.
Conclusion
The identified vulnerabilities in Flatpak pose significant risks to users and their systems. It is essential to update to the latest patched version to mitigate these risks. Users should remain vigilant and consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for flatpak →
FAQ
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux, ensuring consistent behavior across different distributions.
The main vulnerabilities include arbitrary code execution, arbitrary write access as root, buffer overflow, and local privilege escalation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
If immediate updates are not possible, consider limiting the permissions of Flatpak applications and avoiding untrusted applications until the vulnerabilities are patched.
For more details, refer to the CVE pages listed in the vulnerability report, which provide in-depth information about each specific vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for flatpak.
