CVE-2026-10037

Description

A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.

PUBLISHED Reserved 2026-05-28 | Published 2026-07-08 | Updated 2026-07-14 | Assigner canonical

Problem types

CWE-20 Improper input validation

Product status

Credits

Aaron Rainbolt finder

References

bugs.launchpad.net/ubuntu/+source/openjdk-25/+bug/2153100 issue-tracking

cve.org (CVE-2026-10037)

nvd.nist.gov (CVE-2026-10037)

Download JSON