CVE-2026-96807

Name of the Vulnerable Software and Affected Versions Flatpak versions prior to 1.18.1

Description A malicious sandboxed application can replace the ~/.var/app/$appid/.ld.so file with a symlink. This action causes the regenerate ld cache() function to write files to an arbitrary location. Because the attacker cannot control the filenames or the content being written, exploitation is difficult.

Recommendations Update to version 1.18.1 or later.