CVE-2026-10037

A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.0 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://bugs.launchpad.net/ubuntu/+source/openjdk-25/+bug/2153100

Configurations

No configuration.

History

No history.

Information

Published : 2026-07-08 22:17

Updated : 2026-07-14 15:16

NVD link : CVE-2026-10037

Mitre link : CVE-2026-10037

CVE.ORG link : CVE-2026-10037

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2026-10037", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10037", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-10T03:55:37.353524Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}]}, "affected": [{"source": "security@ubuntu.com", "affectedData": [{"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-8", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-9", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-13", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-16", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-17", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-18", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-21", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-25", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-lts", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "versions": [{"status": "affected", "version": "0", "lessThan": "3.70+nmu1ubuntu1.22.04.1", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "3.70+nmu1ubuntu1.24.04.1", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "3.74ubuntu1.1", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "3.75ubuntu1.1", "versionType": "custom"}], "packageName": "mailcap", "defaultStatus": "unaffected"}]}], "published": "2026-07-08T22:17:12.500", "references": [{"url": "https://bugs.launchpad.net/ubuntu/+source/openjdk-25/+bug/2153100", "source": "security@ubuntu.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment."}], "lastModified": "2026-07-14T15:16:54.877", "sourceIdentifier": "security@ubuntu.com"}