DEBIAN-CVE-2026-48831

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-48831
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-48831.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-48831
Upstream
Published
2026-05-24T22:16:16Z
Modified
2026-09-14T17:03:16Z
Severity
  • 7.3 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:Clear CVSS Calculator
Summary
[none]
Details

Wine ships a .desktop file that registers itself as a MIME handler for EXE files and several other Windows executable file types. In some configurations, handling of an EXE file causes that file to be blindly executed with the permissions of the invoker. This allows escaping Flatpak and Snap sandboxes, because MIME handlers are not intended for use by code interpreters and loaders. NOTE: some parties feel that this is not a bug to be addressed in Wine, because there is no known solution that avoids a severe loss of usability (Wine could be a binfmt-misc handler, but binfmt-misc does not exist on all platforms supported by Wine).

References

Affected packages

Debian:12 / wine

Package

Name
wine
Purl
pkg:deb/debian/wine?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

8.*
8.0~repack-4
8.0.1~repack-1
8.0.1~repack-2
8.0.1~repack-3
8.0.2~repack-1
8.0.2~repack-2
9.*
9.0~repack-1
9.0~repack-2
9.0~repack-3
9.0~repack-4
9.0~repack-5
9.0~repack-6
9.0~repack-7
10.*
10.0~rc1~repack-1
10.0~rc2~repack-1
10.0~rc2~repack-2
10.0~rc2~repack-3
10.0~rc2~repack-4
10.0~repack-1
10.0~repack-2
10.0~repack-3
10.0~repack-4
10.0~repack-5
10.0~repack-6
10.0~repack-7
10.0~repack-8
10.0~repack-9
10.0~repack-10
10.0~repack-11
10.0~repack-12

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-48831.json"

Debian:13 / wine

Package

Name
wine
Purl
pkg:deb/debian/wine?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

10.*
10.0~repack-6
10.0~repack-7
10.0~repack-8
10.0~repack-9
10.0~repack-10
10.0~repack-11
10.0~repack-12

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-48831.json"