Vulnerability · Published Jul 8, 2026 · Assigned by canonical
CVE-2026-10037Sandbox Escape in Ubuntu OpenJDK Packages via xdg-desktop-portal
High 8.8
In plain English
A high-severity improper input validation in Ubuntu from Canonical. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | mailcap | 3.70+nmu1ubuntu1.22.04.1 | UBUNTU-CVE-2026-10037 |
| Ubuntu:24.04:LTS | mailcap | 3.70+nmu1ubuntu1.24.04.1 | UBUNTU-CVE-2026-10037 |
| Ubuntu:25.10 | mailcap | 3.74ubuntu1.1 | UBUNTU-CVE-2026-10037 |
| Ubuntu:26.04:LTS | mailcap | 3.75ubuntu1.1 | UBUNTU-CVE-2026-10037 |
| Ubuntu:26.10 | mailcap | no fix listed | UBUNTU-CVE-2026-10037 |
| Ubuntu:26.10 | openjdk-17 | no fix listed | UBUNTU-CVE-2026-10037 |
| Ubuntu:26.10 | openjdk-17-crac | no fix listed | UBUNTU-CVE-2026-10037 |
| Ubuntu:22.04:LTS | openjdk-18 | no fix listed | UBUNTU-CVE-2026-10037 |
| Ubuntu:26.10 | openjdk-21 | no fix listed | UBUNTU-CVE-2026-10037 |
| Ubuntu:26.10 | openjdk-21-crac | no fix listed | UBUNTU-CVE-2026-10037 |
| Ubuntu:26.10 | openjdk-8 | no fix listed | UBUNTU-CVE-2026-10037 |
| Ubuntu:26.10 | openjdk-lts | no fix listed | UBUNTU-CVE-2026-10037 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Canonical | Ubuntu | see references |
| Canonical | Ubuntu | see references |
| Canonical | Ubuntu | see references |
| Canonical | Ubuntu | see references |
| Canonical | Ubuntu | see references |
| Canonical | Ubuntu | see references |
| Canonical | Ubuntu | see references |
| Canonical | Ubuntu | see references |
| Canonical | Ubuntu | see references |
| Canonical | Ubuntu | 0 – before 3.70+nmu1ubuntu1.22.04.10 – before 3.70+nmu1ubuntu1.24.04.10 – before 3.74ubuntu1.10 – before 3.75ubuntu1.1 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H