Vulnerability in oma Package Manager Affects AOSC OS

CVE-2026-39958

What is CVE-2026-39958?

The oma package manager for AOSC OS is susceptible to an improper input validation issue through its oma-topics component. Prior to version 1.25.2, oma-topics fails to validate the name field in the metadata of 'Topic Manifests.' A malicious actor can exploit this vulnerability by supplying a crafted Topic Manifest, which may lead to the inclusion of harmful APT source entries into /etc/apt/sources.list.d/atm.list. This security flaw allows for potential manipulation of package sources, posing risks to system integrity and security. The issue has been rectified in version 1.25.2.

References