CVE-2026-97027

Name of the Vulnerable Software and Affected Versions Flatpak (affected versions not specified)

Description Flatpak fails to validate vendor-extension keys against an allowlist when exporting an application's Desktop Entry (.desktop) and D-Bus Service (.service) files, passing them through unmodified. A malicious application can exploit this to cause a denial of service, such as forcing application restart loops, or to influence host D-Bus or systemd activation behavior, bypassing intended sandbox restrictions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.