USN-8779-2
bubblewrap regression
USN-8779-1 fixed vulnerabilities in Bubblewrap. Unfortunately, the fix for CVE-2026-87766 introduced a regression in symlink resolution, preventing certain Flatpak applications from launching. This update reverts that fix until a complete fix is available.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Bubblewrap incorrectly handled certain temporary directories. A local attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-12439)
It was discovered that Bubblewrap incorrectly handled certain symlinks during sandbox setup. A local attacker could possibly use this issue to create files outside of the sandbox. (CVE-2026-87766)
What each source reports
OSV No score
bubblewrap regression
USN-8779-1 fixed vulnerabilities in Bubblewrap. Unfortunately, the fix for CVE-2026-87766 introduced a regression in symlink resolution, preventing certain Flatpak applications from launching. This update reverts that fix until a complete fix is available.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Bubblewrap incorrectly handled certain temporary directories. A local attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-12439)
It was discovered that Bubblewrap incorrectly handled certain symlinks during sandbox setup. A local attacker could possibly use this issue to create files outside of the sandbox. (CVE-2026-87766)
- Record
USN-8779-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bubblewrapUbuntu:Pro:18.04:LTS |
before 0.2.1-1ubuntu0.1+esm3, plus listed versions 0.2.0-10.2.0-20.2.0-40.2.1-10.2.1-1ubuntu0.10.2.1-1ubuntu0.1+esm2 |
0.2.1-1ubuntu0.1+esm3 |
bubblewrapUbuntu:Pro:20.04:LTS |
before 0.4.0-1ubuntu4.1+esm3, plus listed versions 0.3.3-20.4.0-10.4.0-1ubuntu10.4.0-1ubuntu20.4.0-1ubuntu30.4.0-1ubuntu40.4.0-1ubuntu4.10.4.0-1ubuntu4.1+esm2 |
0.4.0-1ubuntu4.1+esm3 |
bubblewrapUbuntu:22.04:LTS |
before 0.6.1-1ubuntu0.3, plus listed versions 0.4.1-3build10.5.0-10.6.0-10.6.1-10.6.1-1ubuntu0.10.6.1-1ubuntu0.2 |
0.6.1-1ubuntu0.3 |
bubblewrapUbuntu:24.04:LTS |
before 0.9.0-1ubuntu0.3, plus listed versions 0.8.0-20.9.0-1build10.9.0-1ubuntu0.10.9.0-1ubuntu0.2 |
0.9.0-1ubuntu0.3 |
bubblewrapUbuntu:26.04:LTS |
before 0.11.1-1ubuntu0.3, plus listed versions 0.11.0-20.11.0-2build10.11.1-10.11.1-1ubuntu0.10.11.1-1ubuntu0.2 |
0.11.1-1ubuntu0.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-8779-2 is a vulnerability with no CVSS score yet in bubblewrap, published September 17, 2026. No source lists public exploit code. Fixed in bubblewrap 0.2.1-1ubuntu0.1+esm3.