CVE catalog

CVE-2026-92162

flatpak: CVE-2026-92162

Severity: High · CVSS 7.2CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published: Sep 22, 2026, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.23% · Oct 25, 2026

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured (most common on Fedora systems), a malicious local user in an active local session could use a crafted architecture name to trick the `flatpak-system-helper` process into creating a root-owned directory tree with contents determined by the OCI remote, plus a root-owned `lock` file and `icons` directory, outside the intended root directory. If this vulnerability is combined with other vulnerabilities also fixed in 1.18.1, the combination can lead to local root privilege escalation. This particular vulnerability is not believed to be exploitable if there are no OCI remotes configured (common on non-Fedora systems). Version 1.18.1 patches the issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	flatpak	sid	`1.18.4-1`	fixed
Debian	flatpak	forky	`1.18.4-1`	fixed
Debian	flatpak	trixie	`1.16.6-1~deb13u2`	vulnerable
Debian	flatpak	trixie-security	`1.16.6-1~deb13u3`	fixed
Debian	flatpak	bookworm	`1.14.10-1~deb12u2`	vulnerable
Debian	flatpak	bookworm-security	`1.14.10-1~deb12u2`	vulnerable
Ubuntu	flatpak	pro	`1.14.4-2`	vulnerable
Ubuntu	flatpak	pro	`1.14.5-1`	vulnerable
Ubuntu	flatpak	pro	`1.14.5-1build1`	vulnerable
Ubuntu	flatpak	pro	`1.14.5-1build4`	vulnerable
Ubuntu	flatpak	pro	`1.14.5-1build5`	vulnerable
Ubuntu	flatpak	pro	`1.14.5-1build6`	vulnerable
Ubuntu	flatpak	pro	`1.14.6-1`	vulnerable
Ubuntu	flatpak	pro	`1.14.6-1ubuntu0.1`	vulnerable
Ubuntu	flatpak	pro	`1.14.6-1ubuntu0.1+esm1`	vulnerable
Ubuntu	flatpak	26.04	`1.16.1-2ubuntu1`	vulnerable
Ubuntu	flatpak	26.04	`1.16.1-3ubuntu1`	vulnerable
Ubuntu	flatpak	26.04	`1.16.2-1`	vulnerable
Ubuntu	flatpak	26.04	`1.16.3-1`	vulnerable
Ubuntu	flatpak	26.04	`1.16.3-1build1`	vulnerable
Ubuntu	flatpak	26.04	`1.16.4-1`	vulnerable
Ubuntu	flatpak	26.04	`1.16.4-2`	vulnerable
Ubuntu	flatpak	26.04	`1.16.6-1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	flatpak	source	sid	`1.18.1-1`	not yet assigned	Not reported	[1144130]
Debian	flatpak	source	forky	`1.18.1-1`	not yet assigned	Not reported	[1144130]
Debian	flatpak	source	trixie	`1.16.6-1~deb13u3`	not yet assigned	Not reported	[1144130]
Debian	flatpak	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1144130]

[Debian bug #1144130]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[flatpak]Affected
Details (6)
- 1.14.10-1~deb12u2 · amd64 · bookworm
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.14.10-1~deb12u2 · arm64 · bookworm
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.16.6-1~deb13u1~bpo12+1 · amd64 · bookworm-backports
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.16.6-1~deb13u1~bpo12+1 · arm64 · bookworm-backports
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.14.10-1~deb12u2 · amd64 · bookworm-security
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.14.10-1~deb12u2 · arm64 · bookworm-security
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
[flatpak-tests]Affected
Source package: [flatpak]
Details (6)
- 1.14.10-1~deb12u2 · amd64 · bookworm
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.14.10-1~deb12u2 · arm64 · bookworm
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.16.6-1~deb13u1~bpo12+1 · amd64 · bookworm-backports
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.16.6-1~deb13u1~bpo12+1 · arm64 · bookworm-backports
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.14.10-1~deb12u2 · amd64 · bookworm-security
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.14.10-1~deb12u2 · arm64 · bookworm-security
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
[gir1.2-flatpak-1.0]Affected
Source package: [flatpak]
Details (6)
- 1.14.10-1~deb12u2 · amd64 · bookworm
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.14.10-1~deb12u2 · arm64 · bookworm
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.16.6-1~deb13u1~bpo12+1 · amd64 · bookworm-backports
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.16.6-1~deb13u1~bpo12+1 · arm64 · bookworm-backports
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.14.10-1~deb12u2 · amd64 · bookworm-security
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.14.10-1~deb12u2 · arm64 · bookworm-security
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
[libflatpak0]Affected
Source package: [flatpak]
Details (6)
- 1.14.10-1~deb12u2 · amd64 · bookworm
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.14.10-1~deb12u2 · arm64 · bookworm
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.16.6-1~deb13u1~bpo12+1 · amd64 · bookworm-backports
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.16.6-1~deb13u1~bpo12+1 · arm64 · bookworm-backports
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.14.10-1~deb12u2 · amd64 · bookworm-security
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.14.10-1~deb12u2 · arm64 · bookworm-security
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
[libflatpak-dev]Affected
Source package: [flatpak]
Details (6)
- 1.14.10-1~deb12u2 · amd64 · bookworm
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.14.10-1~deb12u2 · arm64 · bookworm
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.16.6-1~deb13u1~bpo12+1 · amd64 · bookworm-backports
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.16.6-1~deb13u1~bpo12+1 · arm64 · bookworm-backports
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.14.10-1~deb12u2 · amd64 · bookworm-security
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.14.10-1~deb12u2 · arm64 · bookworm-security
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
[libflatpak-doc]Affected
Source package: [flatpak]
Details (6)
- 1.14.10-1~deb12u2 · all · bookworm
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.14.10-1~deb12u2 · all · bookworm
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.16.6-1~deb13u1~bpo12+1 · all · bookworm-backports
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.16.6-1~deb13u1~bpo12+1 · all · bookworm-backports
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.14.10-1~deb12u2 · all · bookworm-security
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12
- 1.14.10-1~deb12u2 · all · bookworm-security
  Affected
  dsa · flatpak · debian · bookworm; dsa · flatpak · debian · 12

[Debian 13 (Trixie)]

[flatpak]Affected
Details (6)
- 1.16.6-1~deb13u1 · amd64 · trixie
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u1 · arm64 · trixie
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u1 · amd64 · trixie-security · Historical version
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u2 · arm64 · trixie-security
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
[flatpak-tests]Affected
Source package: [flatpak]
Details (6)
- 1.16.6-1~deb13u1 · amd64 · trixie
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u1 · arm64 · trixie
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u1 · amd64 · trixie-security · Historical version
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u2 · arm64 · trixie-security
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
[gir1.2-flatpak-1.0]Affected
Source package: [flatpak]
Details (6)
- 1.16.6-1~deb13u1 · amd64 · trixie
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u1 · arm64 · trixie
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u1 · amd64 · trixie-security · Historical version
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u2 · arm64 · trixie-security
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
[libflatpak0]Affected
Source package: [flatpak]
Details (6)
- 1.16.6-1~deb13u1 · amd64 · trixie
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u1 · arm64 · trixie
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u1 · amd64 · trixie-security · Historical version
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u2 · arm64 · trixie-security
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
[libflatpak-dev]Affected
Source package: [flatpak]
Details (6)
- 1.16.6-1~deb13u1 · amd64 · trixie
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u1 · arm64 · trixie
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u1 · amd64 · trixie-security · Historical version
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u2 · amd64 · trixie-security · Historical version
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u2 · arm64 · trixie-security
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
[libflatpak-doc]Affected
Source package: [flatpak]
Details (6)
- 1.16.6-1~deb13u1 · all · trixie
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u1 · all · trixie
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u1 · all · trixie-security · Historical version
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u2 · all · trixie-security
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u2 · all · trixie-security · Historical version
  Affected · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13
- 1.16.6-1~deb13u3 · all · trixie-security
  Fixed · Fixed: 1.16.6-1~deb13u3
  dsa · flatpak · debian · 13

Observed: Oct 27, 2026, 5:44:17 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]