Local Privilege Escalation Vulnerability in Flatpak on Linux Systems

CVE-2026-92162

What is CVE-2026-92162?

A flaw has been identified in Flatpak, the system for sandboxed desktop applications on Linux. This vulnerability allows a malicious local user, during an active session, to employ a specially crafted architecture name to exploit the flatpak-system-helper process. This can lead to the creation of a root-owned directory tree and a lock file, along with an icons directory, outside the intended directory structure if at least one OCI remote is configured. While this vulnerability primarily affects Fedora systems, its exploitation may lead to local root privilege escalation when combined with other vulnerabilities fixed in version 1.18.1. Systems without OCI remotes are not considered vulnerable.

References