{"id":"CVE-2026-10037","aliases":["BELL-CVE-2026-10037","EUVD-2026-42435","GHSA-xg8h-3f4m-39v6","UBUNTU-CVE-2026-10037","USN-8518-1"],"status":"published","title":"Sandbox Escape in Ubuntu OpenJDK Packages via xdg-desktop-portal","description":"A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00176,"percentile":0.07148,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2026-07-08T17:15:41Z","modified":"2026-11-10T02:50:21Z","fixes":[{"ecosystem":"Ubuntu:22.04:LTS","package":"mailcap","fixed_in":["3.70+nmu1ubuntu1.22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"mailcap","fixed_in":["3.70+nmu1ubuntu1.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"mailcap","fixed_in":["3.74ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"mailcap","fixed_in":["3.75ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openjdk-9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9~b88-1","9~b101-2ubuntu2","9~b102-1","9~b113-0ubuntu1","9~b114-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openjdk-13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["13+33-1","13.0.1+9-2","13.0.2+8-1","13.0.2+8-2","13.0.3+3-1ubuntu2","13.0.4+8-1~20.04","13.0.7+5-0ubuntu1~20.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openjdk-16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["16.0.1+9-1~20.04"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mailcap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.70+nmu1ubuntu1.22.04.1"}]}],"versions":["3.69ubuntu1","3.70ubuntu1","3.70+nmu1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openjdk-18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18~15ea-4","18~20ea-1","18~32ea-1","18~36ea-1","18.0.2+9-2~22.04"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mailcap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.70+nmu1ubuntu1.24.04.1"}]}],"versions":["3.70+nmu1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"mailcap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.74ubuntu1.1"}]}],"versions":["3.74ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"mailcap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.75ubuntu1","3.76ubuntu1","3.77ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openjdk-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["17.0.18+8-1","17.0.19+10-1","17.0.20~5ea-1","17.0.20+8-1","17.0.20.1+1-1","17.0.21~6ea-1","17.0.21.0.3+1-1~26.10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openjdk-17-crac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["17.0.18+8-0ubuntu1","17.0.19+10-0ubuntu1","17.0.20+8-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openjdk-21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.0.11~8ea-1","21.0.11+10-1","21.0.12~5ea-1","21.0.12+8-1","21.0.12.1+1-1","21.0.13.0.3+1-1~26.10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openjdk-21-crac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.0.10+7-0ubuntu1","21.0.11+10-0ubuntu1","21.0.12+8-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openjdk-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8u482-ga~us1-0ubuntu1","8u492-ga~us2-0ubuntu2","8u502-ga~us1-0ubuntu1","8u504-ga-1ubuntu1","8u512-b09~us1-0ubuntu1~26.10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openjdk-lts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.0.30+7-1ubuntu1","11.0.31+11-1ubuntu2","11.0.32+9-1ubuntu1","11.0.32.1+1-1ubuntu1","11.0.32.1+1-1ubuntu2","11.0.33+9-1ubuntu1~26.10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"mailcap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.75ubuntu1.1"}]}],"versions":["3.74ubuntu1","3.75ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mailcap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.70+nmu1ubuntu1.22.04.1"}]}],"versions":["3.69ubuntu1","3.70ubuntu1","3.70+nmu1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mailcap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.70+nmu1ubuntu1.24.04.1"}]}],"versions":["3.70+nmu1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"mailcap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.74ubuntu1.1"}]}],"versions":["3.74ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"mailcap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.75ubuntu1.1"}]}],"versions":["3.74ubuntu1","3.75ubuntu1"]}],"products":[{"vendor":"canonical","product":"ubuntu"}],"references":[{"url":"https://bugs.launchpad.net/ubuntu/+source/openjdk-25/+bug/2153100","tags":["issue-tracking","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10037"},{"url":"https://github.com/advisories/GHSA-xg8h-3f4m-39v6"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-10037","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-10037","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-10037","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8518-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-10037","title":"Sandbox Escape in Ubuntu OpenJDK Packages via xdg-desktop-portal","description":"A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.","status":"published","published":"2026-07-08T21:18:56.577Z","modified":"2026-07-14T14:33:19.237Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T13:40:12.486331Z"}],"euvd":[{"id":"EUVD-2026-42435","description":"A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.","status":"published","published":"2026-07-08T21:18:56Z","modified":"2026-07-14T14:33:19Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:59.713046Z"}],"ghsa":[{"id":"GHSA-xg8h-3f4m-39v6","title":"A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME...","description":"A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.","status":"published","published":"2026-07-09T00:31:14Z","modified":"2026-07-09T00:31:19Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:09:20.981798Z"}],"nvd":[{"id":"CVE-2026-10037","description":"A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.","status":"published","published":"2026-07-08T22:17:12.5Z","modified":"2026-10-25T17:10:00.197Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:12:28.4135Z"}],"osv":[{"id":"BELL-CVE-2026-10037","title":"CVE-2026-10037 does not affect BellSoft software","status":"withdrawn","published":"2026-07-10T06:04:06.293678Z","modified":"2026-07-11T07:15:05.895987222Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"UBUNTU-CVE-2026-10037","description":"A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.","status":"published","published":"2026-07-08T21:18:56Z","modified":"2026-11-10T02:50:21.584170848Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-10T03:18:57.092165Z"},{"id":"USN-8518-1","title":"mailcap vulnerability","description":"Aaron Rainbolt discovered that the cautious-launcher utility in the\nmailcap package did not properly restrict the execution of certain\nfile types. An attacker could use this issue to escape a sandboxed\napplication and execute arbitrary code on the host operating system.","status":"published","published":"2026-07-08T17:15:41Z","modified":"2026-07-09T21:30:41.445309092Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}