{"id":"UBUNTU-CVE-2026-107050","details":"An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in their uid, leading to arbitrary code execution.","modified":"2026-10-31T03:30:07.456876622Z","published":"2026-10-30T00:00:00Z","upstream":["CVE-2026-107050"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-107050"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-107050"},{"type":"REPORT","url":"https://f-droid.org/packages/com.retroarch/"},{"type":"REPORT","url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107050.md"},{"type":"REPORT","url":"https://github.com/libretro/RetroArch"},{"type":"REPORT","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9136"}],"affected":[{"package":{"name":"retroarch","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/retroarch?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.1+dfsg1-1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.4.1+dfsg1-1","binary_name":"retroarch"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-107050.json"}},{"package":{"name":"retroarch","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/retroarch?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.3+dfsg1-1build1","1.7.3+dfsg1-1.1"],"ecosystem_specific":{"binaries":[{"binary_name":"retroarch","binary_version":"1.7.3+dfsg1-1.1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-107050.json"}},{"package":{"name":"retroarch","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/retroarch?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.3+dfsg1-1.1build1"],"ecosystem_specific":{"binaries":[{"binary_name":"retroarch","binary_version":"1.7.3+dfsg1-1.1build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-107050.json"}},{"package":{"name":"retroarch","ecosystem":"Ubuntu:Pro:24.04:LTS","purl":"pkg:deb/ubuntu/retroarch?arch=source&distro=esm-apps%2Fnoble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.0+dfsg-1build1","1.15.0+dfsg-1","1.16.0.3+dfsg-1","1.18.0+dfsg-1","1.18.0+dfsg-1ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"retroarch","binary_version":"1.18.0+dfsg-1ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-107050.json"}},{"package":{"name":"retroarch","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/retroarch?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.2+dfsg-2ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"retroarch","binary_version":"1.22.2+dfsg-2ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-107050.json"}},{"package":{"name":"retroarch","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/retroarch?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.0+dfsg-3","1.22.2+dfsg-1","1.22.2+dfsg-2","1.22.2+dfsg-2build1","1.22.2+dfsg-2ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"retroarch","binary_version":"1.22.2+dfsg-2ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-107050.json"}}],"schema_version":"1.9.2","severity":[{"type":"Ubuntu","score":"medium"}]}