CVE-2026-10037
Sandbox Escape in Ubuntu OpenJDK Packages via xdg-desktop-portal
A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Sandbox Escape in Ubuntu OpenJDK Packages via xdg-desktop-portal
A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.
- Record
CVE-2026-10037- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2026-42435
A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.
- Record
EUVD-2026-42435- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xg8h-3f4m-39v6
A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME...
A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.
- Record
GHSA-xg8h-3f4m-39v6- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.
- Record
CVE-2026-10037- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVBELL-CVE-2026-10037
CVE-2026-10037 does not affect BellSoft software
- Record
BELL-CVE-2026-10037- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-10037
A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.
- Record
UBUNTU-CVE-2026-10037- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-8518-1 No score
mailcap vulnerability
Aaron Rainbolt discovered that the cautious-launcher utility in the mailcap package did not properly restrict the execution of certain file types. An attacker could use this issue to escape a sandboxed application and execute arbitrary code on the host operating system.
- Record
USN-8518-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openjdk-9Ubuntu:16.04:LTS |
All versions, plus listed versions 9~b88-19~b101-2ubuntu29~b102-19~b113-0ubuntu19~b114-0ubuntu1 |
None known |
openjdk-13Ubuntu:20.04:LTS |
All versions, plus listed versions 13+33-113.0.1+9-213.0.2+8-113.0.2+8-213.0.3+3-1ubuntu213.0.4+8-1~20.0413.0.7+5-0ubuntu1~20.04 |
None known |
openjdk-16Ubuntu:20.04:LTS |
All versions, plus listed versions 16.0.1+9-1~20.04 |
None known |
mailcapUbuntu:22.04:LTS |
before 3.70+nmu1ubuntu1.22.04.1, plus listed versions 3.69ubuntu13.70ubuntu13.70+nmu1ubuntu1 |
3.70+nmu1ubuntu1.22.04.1 |
openjdk-18Ubuntu:22.04:LTS |
All versions, plus listed versions 18~15ea-418~20ea-118~32ea-118~36ea-118.0.2+9-2~22.04 |
None known |
mailcapUbuntu:24.04:LTS |
before 3.70+nmu1ubuntu1.24.04.1, plus listed versions 3.70+nmu1ubuntu1 |
3.70+nmu1ubuntu1.24.04.1 |
mailcapUbuntu:25.10 |
before 3.74ubuntu1.1, plus listed versions 3.74ubuntu1 |
3.74ubuntu1.1 |
mailcapUbuntu:26.10 |
All versions, plus listed versions 3.75ubuntu13.76ubuntu13.77ubuntu1 |
None known |
openjdk-17Ubuntu:26.10 |
All versions, plus listed versions 17.0.18+8-117.0.19+10-117.0.20~5ea-117.0.20+8-117.0.20.1+1-117.0.21~6ea-1 |
None known |
openjdk-17-cracUbuntu:26.10 |
All versions, plus listed versions 17.0.18+8-0ubuntu117.0.19+10-0ubuntu117.0.20+8-0ubuntu1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openjdk-21Ubuntu:26.10 |
All versions, plus listed versions 21.0.11~8ea-121.0.11+10-121.0.12~5ea-121.0.12+8-121.0.12.1+1-1 |
None known |
openjdk-21-cracUbuntu:26.10 |
All versions, plus listed versions 21.0.10+7-0ubuntu121.0.11+10-0ubuntu121.0.12+8-0ubuntu1 |
None known |
openjdk-8Ubuntu:26.10 |
All versions, plus listed versions 8u482-ga~us1-0ubuntu18u492-ga~us2-0ubuntu28u502-ga~us1-0ubuntu18u504-ga-1ubuntu1 |
None known |
openjdk-ltsUbuntu:26.10 |
All versions, plus listed versions 11.0.30+7-1ubuntu111.0.31+11-1ubuntu211.0.32+9-1ubuntu111.0.32.1+1-1ubuntu111.0.32.1+1-1ubuntu2 |
None known |
mailcapUbuntu:26.04:LTS |
before 3.75ubuntu1.1, plus listed versions 3.74ubuntu13.75ubuntu1 |
3.75ubuntu1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-10037 is a high vulnerability (CVSS 8.8) in Canonical Ubuntu, published July 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in mailcap 3.70+nmu1ubuntu1.22.04.1.