CVE-2026-10037
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Sandbox Escape in Ubuntu OpenJDK Packages via xdg-desktop-portal
A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Ubuntu
- Vendor
- Canonical
- Product
- Ubuntu
- Platforms
- Unknown
- Default status
unaffected- Package
- openjdk-8
No explicit version tuples; consult this entry's default status.
Ubuntu
- Vendor
- Canonical
- Product
- Ubuntu
- Platforms
- Unknown
- Default status
unaffected- Package
- openjdk-9
No explicit version tuples; consult this entry's default status.
Ubuntu
- Vendor
- Canonical
- Product
- Ubuntu
- Platforms
- Unknown
- Default status
unaffected- Package
- openjdk-13
No explicit version tuples; consult this entry's default status.
Ubuntu
- Vendor
- Canonical
- Product
- Ubuntu
- Platforms
- Unknown
- Default status
unaffected- Package
- openjdk-16
No explicit version tuples; consult this entry's default status.
Ubuntu
- Vendor
- Canonical
- Product
- Ubuntu
- Platforms
- Unknown
- Default status
unaffected- Package
- openjdk-17
No explicit version tuples; consult this entry's default status.
Ubuntu
- Vendor
- Canonical
- Product
- Ubuntu
- Platforms
- Unknown
- Default status
unaffected- Package
- openjdk-18
No explicit version tuples; consult this entry's default status.
Ubuntu
- Vendor
- Canonical
- Product
- Ubuntu
- Platforms
- Unknown
- Default status
unaffected- Package
- openjdk-21
No explicit version tuples; consult this entry's default status.
Ubuntu
- Vendor
- Canonical
- Product
- Ubuntu
- Platforms
- Unknown
- Default status
unaffected- Package
- openjdk-25
No explicit version tuples; consult this entry's default status.
Ubuntu
- Vendor
- Canonical
- Product
- Ubuntu
- Platforms
- Unknown
- Default status
unaffected- Package
- openjdk-lts
No explicit version tuples; consult this entry's default status.
Ubuntu
- Vendor
- Canonical
- Product
- Ubuntu
- Platforms
- Unknown
- Default status
unaffected- Package
- mailcap
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | custom | 3.70+nmu1ubuntu1.22.04.1 | Unavailable | None listed |
| 0 | affected | custom | 3.70+nmu1ubuntu1.24.04.1 | Unavailable | None listed |
| 0 | affected | custom | 3.74ubuntu1.1 | Unavailable | None listed |
| 0 | affected | custom | 3.75ubuntu1.1 | Unavailable | None listed |