CVE-2026-10037

A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.0 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://bugs.launchpad.net/ubuntu/+source/openjdk-25/+bug/2153100

Configurations

No configuration.

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad de escape de sandbox en los paquetes OpenJDK proporcionados en Ubuntu. Los gestores MIME de .jar instalados por estos paquetes ejecutan archivos marcados como ejecutables cuando el paquete mailcap está instalado. Una aplicación en sandbox comprometida o maliciosa con acceso al portal OpenURI a través de xdg-desktop-portal-gtk puede escribir un archivo .jar malicioso en el sistema de archivos del host, establecer su bit ejecutable y activar el gestor para ejecutar código arbitrario fuera del entorno de sandbox.

Information

Published : 2026-07-08 22:17

Updated : 2026-10-25 17:10

NVD link : CVE-2026-10037

Mitre link : CVE-2026-10037

CVE.ORG link : CVE-2026-10037

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2026-10037", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10037", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-10T03:55:37.353524Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}]}, "affected": [{"source": "security@ubuntu.com", "affectedData": [{"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-8", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-9", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-13", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-16", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-17", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-18", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-21", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-25", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-lts", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "versions": [{"status": "affected", "version": "0", "lessThan": "3.70+nmu1ubuntu1.22.04.1", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "3.70+nmu1ubuntu1.24.04.1", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "3.74ubuntu1.1", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "3.75ubuntu1.1", "versionType": "custom"}], "packageName": "mailcap", "defaultStatus": "unaffected"}]}], "published": "2026-07-08T22:17:12.500", "references": [{"url": "https://bugs.launchpad.net/ubuntu/+source/openjdk-25/+bug/2153100", "source": "security@ubuntu.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment."}, {"lang": "es", "value": "Existe una vulnerabilidad de escape de sandbox en los paquetes OpenJDK proporcionados en Ubuntu. Los gestores MIME de .jar instalados por estos paquetes ejecutan archivos marcados como ejecutables cuando el paquete mailcap est\u00e1 instalado. Una aplicaci\u00f3n en sandbox comprometida o maliciosa con acceso al portal OpenURI a trav\u00e9s de xdg-desktop-portal-gtk puede escribir un archivo .jar malicioso en el sistema de archivos del host, establecer su bit ejecutable y activar el gestor para ejecutar c\u00f3digo arbitrario fuera del entorno de sandbox."}], "lastModified": "2026-10-25T17:10:00.197", "sourceIdentifier": "security@ubuntu.com"}