CVE-2026-97027

Flatpak: flatpak: denial of service via unsanitized keys in exported desktop entry / d-bus service files

State: Published
Severity: 3.6 Low
Published: Sep 28, 2026
Updated: Sep 29, 2026
Reserved: Sep 23, 2026

Description

Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.desktop) and D-Bus Service (.service) files, instead of validating against an allowlist. A malicious Flatpak app can use this to cause denial of service (e.g. forced application restart loops) or to influence host D-Bus/systemd activation behavior beyond what the sandbox is intended to permit.

Scores

CVSS	Score	Vector	Source
3.1	3.6 Low	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L	redhat

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
Red Hat Enterprise Linux 10Red Hat
Red Hat Enterprise Linux 7Red Hat
Red Hat Enterprise Linux 8Red Hat
Red Hat Enterprise Linux 9Red Hat

References

https://access.redhat.com/security/cve/CVE-2026-97027vdb-entry
RHBZ#2542683issue-tracking
https://github.com/flatpak/flatpak/security/advisories/GHSA-v64f-hrwr-j4vh

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.