USN-8779-2: Bubblewrap regression
Ubuntu issued USN-8779-2 reverting a Bubblewrap symlink fix for CVE-2026-87766 that caused a regression preventing some Flatpak apps from launching.
USN-8779-2 reverts the CVE-2026-87766 fix from USN-8779-1 because it introduced a regression in symlink resolution that stopped certain Flatpak applications from launching; a complete fix is still pending. The original advisory detailed CVE-2019-12439, where mishandled temporary directories could let a local attacker cause denial of service or execute arbitrary code on Ubuntu 18.04 LTS only, plus improper symlink handling during sandbox setup with similar local impact.
- USN-8779-2 reverts the CVE-2026-87766 fix that broke Flatpak app launches
- Regression affected symlink resolution during Bubblewrap sandbox setup
- CVE-2019-12439 allowed local DoS or arbitrary code execution on Ubuntu 18.04 LTS only
- Complete fix for the reverted vulnerability remains pending
- Products
- BubblewrapFlatpak
- Organizations
- Ubuntu
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-12439 | bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point | 7.8 | <1% | ||
| CVE-2026-87766 | Symlink-following sandbox escape (arbitrary file write) in bubblewrap before 0.12.0 | 8.8 | <1% |
From the original article
USN-8779-1 fixed vulnerabilities in Bubblewrap. Unfortunately, the fix for CVE-2026-87766 introduced a regression in symlink resolution, preventing certain Flatpak applications from launching. This update reverts that fix until a complete fix is available.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.