CVE-2026-10037

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10037", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2026-05-28T19:27:23.004Z", "datePublished": "2026-07-08T21:18:56.577Z", "dateUpdated": "2026-07-14T14:33:19.237Z"}, "containers": {"cna": {"title": "Sandbox Escape in Ubuntu OpenJDK Packages via xdg-desktop-portal", "datePublic": "2026-07-08T15:46:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-20", "description": "CWE-20 Improper input validation", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "affected": [{"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-8", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-9", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-13", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-16", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-17", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-18", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-21", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-25", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-lts", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "mailcap", "versions": [{"status": "affected", "version": "0", "lessThan": "3.70+nmu1ubuntu1.22.04.1", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "3.70+nmu1ubuntu1.24.04.1", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "3.74ubuntu1.1", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "3.75ubuntu1.1", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment."}]}], "references": [{"url": "https://bugs.launchpad.net/ubuntu/+source/openjdk-25/+bug/2153100", "tags": ["issue-tracking"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Aaron Rainbolt", "type": "finder"}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-07-08T21:18:56.577Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-10T03:55:37.353524Z", "id": "CVE-2026-10037", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T14:33:19.237Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-10037", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-10T03:55:37.353524Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T12:59:41.191Z"}}], "cna": {"title": "Sandbox Escape in Ubuntu OpenJDK Packages via xdg-desktop-portal", "credits": [{"lang": "en", "type": "finder", "value": "Aaron Rainbolt"}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-8", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-9", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-13", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-16", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-17", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-18", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-21", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-25", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "packageName": "openjdk-lts", "defaultStatus": "unaffected"}, {"vendor": "Canonical", "product": "Ubuntu", "versions": [{"status": "affected", "version": "0", "lessThan": "3.70+nmu1ubuntu1.22.04.1", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "3.70+nmu1ubuntu1.24.04.1", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "3.74ubuntu1.1", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "3.75ubuntu1.1", "versionType": "custom"}], "packageName": "mailcap", "defaultStatus": "unaffected"}], "datePublic": "2026-07-08T15:46:00.000Z", "references": [{"url": "https://bugs.launchpad.net/ubuntu/+source/openjdk-25/+bug/2153100", "tags": ["issue-tracking"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.", "supportingMedia": [{"type": "text/html", "value": "A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper input validation"}]}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-07-08T21:18:56.577Z"}}}, "cveMetadata": {"cveId": "CVE-2026-10037", "state": "PUBLISHED", "dateUpdated": "2026-07-14T14:33:19.237Z", "dateReserved": "2026-05-28T19:27:23.004Z", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "datePublished": "2026-07-08T21:18:56.577Z", "assignerShortName": "canonical"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "openjdk-8", "product": "Ubuntu", "vendor": "Canonical"}, {"defaultStatus": "unaffected", "packageName": "openjdk-9", "product": "Ubuntu", "vendor": "Canonical"}, {"defaultStatus": "unaffected", "packageName": "openjdk-13", "product": "Ubuntu", "vendor": "Canonical"}, {"defaultStatus": "unaffected", "packageName": "openjdk-16", "product": "Ubuntu", "vendor": "Canonical"}, {"defaultStatus": "unaffected", "packageName": "openjdk-17", "product": "Ubuntu", "vendor": "Canonical"}, {"defaultStatus": "unaffected", "packageName": "openjdk-18", "product": "Ubuntu", "vendor": "Canonical"}, {"defaultStatus": "unaffected", "packageName": "openjdk-21", "product": "Ubuntu", "vendor": "Canonical"}, {"defaultStatus": "unaffected", "packageName": "openjdk-25", "product": "Ubuntu", "vendor": "Canonical"}, {"defaultStatus": "unaffected", "packageName": "openjdk-lts", "product": "Ubuntu", "vendor": "Canonical"}, {"defaultStatus": "unaffected", "packageName": "mailcap", "product": "Ubuntu", "vendor": "Canonical", "versions": [{"lessThan": "3.70+nmu1ubuntu1.22.04.1", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "3.70+nmu1ubuntu1.24.04.1", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "3.74ubuntu1.1", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "3.75ubuntu1.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "security@ubuntu.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment."}, {"lang": "es", "value": "Existe una vulnerabilidad de escape de sandbox en los paquetes OpenJDK proporcionados en Ubuntu. Los gestores MIME de .jar instalados por estos paquetes ejecutan archivos marcados como ejecutables cuando el paquete mailcap est\u00e1 instalado. Una aplicaci\u00f3n en sandbox comprometida o maliciosa con acceso al portal OpenURI a trav\u00e9s de xdg-desktop-portal-gtk puede escribir un archivo .jar malicioso en el sistema de archivos del host, establecer su bit ejecutable y activar el gestor para ejecutar c\u00f3digo arbitrario fuera del entorno de sandbox."}], "id": "CVE-2026-10037", "lastModified": "2026-10-25T17:10:00.197", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "security@ubuntu.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10037", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-10T03:55:37.353524Z", "version": "2.0.3"}}]}, "published": "2026-07-08T22:17:12.500", "references": [{"source": "security@ubuntu.com", "url": "https://bugs.launchpad.net/ubuntu/+source/openjdk-25/+bug/2153100"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security@ubuntu.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Ubuntu", "source": "cna", "vendor": "Canonical"}, "product": "ubuntu", "vendor": "canonical"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.70+nmu1ubuntu1.22.04.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.70+nmu1ubuntu1.24.04.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.74ubuntu1.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.75ubuntu1.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Ubuntu", "source": "cna", "vendor": "Canonical"}, "product": "ubuntu", "vendor": "canonical"}], "created": "2026-07-08T23:00:11.690524+00:00", "updated": "2026-08-01T15:30:03.755683+00:00", "vendors": ["canonical", "canonical$PRODUCT$ubuntu"]}