{"id":"UBUNTU-CVE-2026-48831","details":"Wine ships a .desktop file that registers itself as a MIME handler for EXE files and several other Windows executable file types. In some configurations, handling of an EXE file causes that file to be blindly executed with the permissions of the invoker. This allows escaping Flatpak and Snap sandboxes, because MIME handlers are not intended for use by code interpreters and loaders. NOTE: some parties feel that this is not a bug to be addressed in Wine, because there is no known solution that avoids a severe loss of usability (Wine could be a binfmt-misc handler, but binfmt-misc does not exist on all platforms supported by Wine).","modified":"2026-05-27T19:09:52Z","published":"2026-05-24T22:16:00Z","upstream":["CVE-2026-48831"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-48831"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-48831"},{"type":"REPORT","url":"https://bugs.winehq.org/show_bug.cgi?id=59767"},{"type":"REPORT","url":"https://www.openwall.com/lists/oss-security/2026/05/19/1"},{"type":"REPORT","url":"https://www.openwall.com/lists/oss-security/2026/05/25/1"},{"type":"REPORT","url":"http://www.openwall.com/lists/oss-security/2026/05/25/1"}],"affected":[{"package":{"name":"wine","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/wine?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.2-2ubuntu1","2.0.3-1ubuntu1","2.0.4-1ubuntu1","3.0-1ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_version":"3.0-1ubuntu1","binary_name":"fonts-wine"},{"binary_name":"libwine","binary_version":"3.0-1ubuntu1"},{"binary_name":"wine-binfmt","binary_version":"3.0-1ubuntu1"},{"binary_name":"wine-stable","binary_version":"3.0-1ubuntu1"},{"binary_version":"3.0-1ubuntu1","binary_name":"wine32"},{"binary_name":"wine32-preloader","binary_version":"3.0-1ubuntu1"},{"binary_version":"3.0-1ubuntu1","binary_name":"wine32-tools"},{"binary_version":"3.0-1ubuntu1","binary_name":"wine64"},{"binary_version":"3.0-1ubuntu1","binary_name":"wine64-preloader"},{"binary_name":"wine64-tools","binary_version":"3.0-1ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48831.json"}},{"package":{"name":"wine","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/wine?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.2-1","4.0.3-1","5.0~rc3-1ubuntu2","5.0~rc4-1ubuntu1","5.0~rc5-1ubuntu1","5.0~rc6-1ubuntu1","5.0-2ubuntu1","5.0-3","5.0-3ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"fonts-wine","binary_version":"5.0-3ubuntu1"},{"binary_name":"libwine","binary_version":"5.0-3ubuntu1"},{"binary_name":"wine","binary_version":"5.0-3ubuntu1"},{"binary_name":"wine-binfmt","binary_version":"5.0-3ubuntu1"},{"binary_name":"wine32","binary_version":"5.0-3ubuntu1"},{"binary_name":"wine32-preloader","binary_version":"5.0-3ubuntu1"},{"binary_name":"wine32-tools","binary_version":"5.0-3ubuntu1"},{"binary_name":"wine64","binary_version":"5.0-3ubuntu1"},{"binary_version":"5.0-3ubuntu1","binary_name":"wine64-preloader"},{"binary_name":"wine64-tools","binary_version":"5.0-3ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48831.json"}},{"package":{"name":"wine","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/wine?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.3-3ubuntu2","6.0.3~repack-1"],"ecosystem_specific":{"binaries":[{"binary_name":"fonts-wine","binary_version":"6.0.3~repack-1"},{"binary_name":"libwine","binary_version":"6.0.3~repack-1"},{"binary_version":"6.0.3~repack-1","binary_name":"wine"},{"binary_name":"wine-binfmt","binary_version":"6.0.3~repack-1"},{"binary_version":"6.0.3~repack-1","binary_name":"wine32"},{"binary_name":"wine32-preloader","binary_version":"6.0.3~repack-1"},{"binary_version":"6.0.3~repack-1","binary_name":"wine32-tools"},{"binary_name":"wine64","binary_version":"6.0.3~repack-1"},{"binary_version":"6.0.3~repack-1","binary_name":"wine64-preloader"},{"binary_name":"wine64-tools","binary_version":"6.0.3~repack-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48831.json"}},{"package":{"name":"wine","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/wine?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0.1~repack-3ubuntu2","8.0.2~repack-2","9.0~repack-4","9.0~repack-4build2","9.0~repack-4build3"],"ecosystem_specific":{"binaries":[{"binary_version":"9.0~repack-4build3","binary_name":"fonts-wine"},{"binary_name":"libwine","binary_version":"9.0~repack-4build3"},{"binary_name":"wine","binary_version":"9.0~repack-4build3"},{"binary_name":"wine-binfmt","binary_version":"9.0~repack-4build3"},{"binary_name":"wine32","binary_version":"9.0~repack-4build3"},{"binary_name":"wine32-preloader","binary_version":"9.0~repack-4build3"},{"binary_name":"wine32-tools","binary_version":"9.0~repack-4build3"},{"binary_version":"9.0~repack-4build3","binary_name":"wine64"},{"binary_name":"wine64-preloader","binary_version":"9.0~repack-4build3"},{"binary_version":"9.0~repack-4build3","binary_name":"wine64-tools"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48831.json"}},{"package":{"name":"wine","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/wine?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0~repack-4build3","10.0~repack-3ubuntu3","10.0~repack-4ubuntu1","10.0~repack-5ubuntu1","10.0~repack-6ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_version":"10.0~repack-6ubuntu1","binary_name":"fonts-wine"},{"binary_name":"libwine","binary_version":"10.0~repack-6ubuntu1"},{"binary_name":"wine","binary_version":"10.0~repack-6ubuntu1"},{"binary_version":"10.0~repack-6ubuntu1","binary_name":"wine-binfmt"},{"binary_name":"wine32","binary_version":"10.0~repack-6ubuntu1"},{"binary_name":"wine32-preloader","binary_version":"10.0~repack-6ubuntu1"},{"binary_name":"wine32-tools","binary_version":"10.0~repack-6ubuntu1"},{"binary_version":"10.0~repack-6ubuntu1","binary_name":"wine64"},{"binary_name":"wine64-preloader","binary_version":"10.0~repack-6ubuntu1"},{"binary_name":"wine64-tools","binary_version":"10.0~repack-6ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48831.json"}},{"package":{"name":"wine","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/wine?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0~repack-6ubuntu1","10.0~repack-11","10.0~repack-12build1","10.0~repack-12ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"fonts-wine","binary_version":"10.0~repack-12ubuntu1"},{"binary_name":"libwine","binary_version":"10.0~repack-12ubuntu1"},{"binary_name":"wine","binary_version":"10.0~repack-12ubuntu1"},{"binary_version":"10.0~repack-12ubuntu1","binary_name":"wine-binfmt"},{"binary_name":"wine-common","binary_version":"10.0~repack-12ubuntu1"},{"binary_name":"wine32","binary_version":"10.0~repack-12ubuntu1"},{"binary_version":"10.0~repack-12ubuntu1","binary_name":"wine32-preloader"},{"binary_name":"wine32-tools","binary_version":"10.0~repack-12ubuntu1"},{"binary_version":"10.0~repack-12ubuntu1","binary_name":"wine64"},{"binary_name":"wine64-preloader","binary_version":"10.0~repack-12ubuntu1"},{"binary_version":"10.0~repack-12ubuntu1","binary_name":"wine64-tools"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48831.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:N/V:D/U:Clear"},{"type":"Ubuntu","score":"medium"}]}