USN-8779-2: Bubblewrap regression
Ubuntu issued USN-8779-2 reverting a Bubblewrap symlink fix for CVE-2026-87766 that caused a regression preventing some Flatpak apps from launching.
USN-8779-2 reverts the CVE-2026-87766 fix from USN-8779-1 because it introduced a regression in symlink resolution that stopped certain Flatpak applications from launching; a complete fix is still pending. The original advisory detailed CVE-2019-12439, where mishandled temporary directories could let a local attacker cause denial of service or execute arbitrary code on Ubuntu 18.04 LTS only, plus improper symlink handling during sandbox setup with similar local impact.
- USN-8779-2 reverts the CVE-2026-87766 fix that broke Flatpak app launches
- Regression affected symlink resolution during Bubblewrap sandbox setup
- CVE-2019-12439 allowed local DoS or arbitrary code execution on Ubuntu 18.04 LTS only
- Complete fix for the reverted vulnerability remains pending
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-12439 | bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some particular configurations (related to XDG_RUNTIME_DIR), a local attacker may abuse this flaw to prevent other users from executing bubblewrap or potentially execute code. NVD description · AI analysis pending | 7.8 | <1% |
| — | ||
| CVE-2026-87766 | Symlink-following sandbox escape (arbitrary file write) in bubblewrap before 0.12.0 CVE-2026-87766 is a symlink-following flaw (CWE-59) in bubblewrap, the Linux sandboxing tool: during sandbox setup, when bubblewrap creates files or directories under the new root, it can follow a parent symlink through /oldroot onto the host filesystem. The attack is triggered locally (CVSS AV:L/PR:L) before the sandboxed process starts, by an attacker with low privileges who can influence the sandbox setup, for example a sandboxed application being launched or a nested-bwrap scenario, so that writes land at attacker-chosen paths outside the sandbox. The attacker gains the ability to create or overwrite files and directories on the host with the privileges of the user launching the sandbox, breaking the sandbox boundary (CVSS scope-changed, S:C, with high confidentiality, integrity and availability impact; 8.8 High). Any Linux system running bubblewrap versions prior to 0.12.0 is affected, notably desktop distributions where bubblewrap is pulled in as a Flatpak dependency and other tooling that invokes bwrap for sandboxing. No exploitation is currently known: the flaw is not in CISA KEV, no public proof-of-concept is known, and the issue (GHSA-pxhw-h44j-8pfx, assigned by Red Hat) is fixed upstream in bubblewrap 0.12.0. Do: Upgrade bubblewrap to 0.12.0 or install your distribution's patched package, and watch for vendor advisories (the CNA is Red Hat; the issue is tracked as GHSA-pxhw-h44j-8pfx). Check the installed version with bwrap --version and, until patched, avoid launching bwrap sandboxes with attacker-controlled directories or symlinks in the sandbox source tree, and treat nested-sandbox launches as a potential escape vector. No public PoC or in-the-wild exploitation is known, so patching can follow normal maintenance cadence. | 8.8 | <1% |
| masslikely millions of Linux installations (shipped with Flatpak and widely packaged across major distros); exact install counts not published |
USN-8779-1 fixed vulnerabilities in Bubblewrap. Unfortunately, the fix for CVE-2026-87766 introduced a regression in symlink resolution, preventing certain Flatpak applications from launching. This update reverts that fix until a complete fix is available. We apologize for the inconvenience. Original advisory details: It was discovered that Bubblewrap incorrectly handled certain temporary directories. A local attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-12439) It was discovered that Bubblewrap incorrectly handled certain symlinks during sandbox setup. A local attacker could possibly use…
This source does not provide full text. Read it at ubuntu.com.