UBUNTU-CVE-2026-10037

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-10037
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-10037.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-10037
Upstream
  • CVE-2026-10037
Downstream
Related
Published
2026-07-08T21:18:56Z
Modified
2026-11-10T02:50:21Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.

References

Affected packages

Ubuntu:16.04:LTS
openjdk-9

Package

Name
openjdk-9
Purl
pkg:deb/ubuntu/openjdk-9?arch=source&distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

Other
9~b88-1
9~b101-2ubuntu2
9~b102-1
9~b113-0ubuntu1
9~b114-0ubuntu1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "openjdk-9-demo",
            "binary_version": "9~b114-0ubuntu1"
        },
        {
            "binary_name": "openjdk-9-jdk",
            "binary_version": "9~b114-0ubuntu1"
        },
        {
            "binary_name": "openjdk-9-jdk-headless",
            "binary_version": "9~b114-0ubuntu1"
        },
        {
            "binary_name": "openjdk-9-jre",
            "binary_version": "9~b114-0ubuntu1"
        },
        {
            "binary_name": "openjdk-9-jre-headless",
            "binary_version": "9~b114-0ubuntu1"
        },
        {
            "binary_name": "openjdk-9-source",
            "binary_version": "9~b114-0ubuntu1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-10037.json"
Ubuntu:20.04:LTS
openjdk-13

Package

Name
openjdk-13
Purl
pkg:deb/ubuntu/openjdk-13?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

Other
13+33-1
13.*
13.0.1+9-2
13.0.2+8-1
13.0.2+8-2
13.0.3+3-1ubuntu2
13.0.4+8-1~20.04
13.0.7+5-0ubuntu1~20.04

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "openjdk-13-demo",
            "binary_version": "13.0.7+5-0ubuntu1~20.04"
        },
        {
            "binary_name": "openjdk-13-jdk",
            "binary_version": "13.0.7+5-0ubuntu1~20.04"
        },
        {
            "binary_name": "openjdk-13-jdk-headless",
            "binary_version": "13.0.7+5-0ubuntu1~20.04"
        },
        {
            "binary_name": "openjdk-13-jre",
            "binary_version": "13.0.7+5-0ubuntu1~20.04"
        },
        {
            "binary_name": "openjdk-13-jre-headless",
            "binary_version": "13.0.7+5-0ubuntu1~20.04"
        },
        {
            "binary_name": "openjdk-13-jre-zero",
            "binary_version": "13.0.7+5-0ubuntu1~20.04"
        },
        {
            "binary_name": "openjdk-13-source",
            "binary_version": "13.0.7+5-0ubuntu1~20.04"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-10037.json"
openjdk-16

Package

Name
openjdk-16
Purl
pkg:deb/ubuntu/openjdk-16?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

16.*
16.0.1+9-1~20.04

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "openjdk-16-demo",
            "binary_version": "16.0.1+9-1~20.04"
        },
        {
            "binary_name": "openjdk-16-jdk",
            "binary_version": "16.0.1+9-1~20.04"
        },
        {
            "binary_name": "openjdk-16-jdk-headless",
            "binary_version": "16.0.1+9-1~20.04"
        },
        {
            "binary_name": "openjdk-16-jre",
            "binary_version": "16.0.1+9-1~20.04"
        },
        {
            "binary_name": "openjdk-16-jre-headless",
            "binary_version": "16.0.1+9-1~20.04"
        },
        {
            "binary_name": "openjdk-16-jre-zero",
            "binary_version": "16.0.1+9-1~20.04"
        },
        {
            "binary_name": "openjdk-16-source",
            "binary_version": "16.0.1+9-1~20.04"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-10037.json"
Ubuntu:22.04:LTS
mailcap

Package

Name
mailcap
Purl
pkg:deb/ubuntu/mailcap?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.70+nmu1ubuntu1.22.04.1

Affected versions

3.*
3.69ubuntu1
3.70ubuntu1
3.70+nmu1ubuntu1

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "mailcap",
            "binary_version": "3.70+nmu1ubuntu1.22.04.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-10037.json"
openjdk-18

Package

Name
openjdk-18
Purl
pkg:deb/ubuntu/openjdk-18?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

Other
18~15ea-4
18~20ea-1
18~32ea-1
18~36ea-1
18.*
18.0.2+9-2~22.04

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "openjdk-18-demo",
            "binary_version": "18.0.2+9-2~22.04"
        },
        {
            "binary_name": "openjdk-18-jdk",
            "binary_version": "18.0.2+9-2~22.04"
        },
        {
            "binary_name": "openjdk-18-jdk-headless",
            "binary_version": "18.0.2+9-2~22.04"
        },
        {
            "binary_name": "openjdk-18-jre",
            "binary_version": "18.0.2+9-2~22.04"
        },
        {
            "binary_name": "openjdk-18-jre-headless",
            "binary_version": "18.0.2+9-2~22.04"
        },
        {
            "binary_name": "openjdk-18-jre-zero",
            "binary_version": "18.0.2+9-2~22.04"
        },
        {
            "binary_name": "openjdk-18-source",
            "binary_version": "18.0.2+9-2~22.04"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-10037.json"
Ubuntu:24.04:LTS
mailcap

Package

Name
mailcap
Purl
pkg:deb/ubuntu/mailcap?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.70+nmu1ubuntu1.24.04.1

Affected versions

3.*
3.70+nmu1ubuntu1

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "mailcap",
            "binary_version": "3.70+nmu1ubuntu1.24.04.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-10037.json"
Ubuntu:25.10
mailcap

Package

Name
mailcap
Purl
pkg:deb/ubuntu/mailcap?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.74ubuntu1.1

Affected versions

3.*
3.74ubuntu1

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "mailcap",
            "binary_version": "3.74ubuntu1.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-10037.json"
Ubuntu:26.04:LTS
mailcap

Package

Name
mailcap
Purl
pkg:deb/ubuntu/mailcap?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.75ubuntu1.1

Affected versions

3.*
3.74ubuntu1
3.75ubuntu1

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "mailcap",
            "binary_version": "3.75ubuntu1.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-10037.json"
Ubuntu:26.10
mailcap

Package

Name
mailcap
Purl
pkg:deb/ubuntu/mailcap?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.75ubuntu1
3.76ubuntu1
3.77ubuntu1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "mailcap",
            "binary_version": "3.77ubuntu1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-10037.json"
openjdk-17

Package

Name
openjdk-17
Purl
pkg:deb/ubuntu/openjdk-17?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

17.*
17.0.18+8-1
17.0.19+10-1
17.0.20~5ea-1
17.0.20+8-1
17.0.20.1+1-1
17.0.21~6ea-1
17.0.21.0.3+1-1~26.10.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "openjdk-17-demo",
            "binary_version": "17.0.21.0.3+1-1~26.10.1"
        },
        {
            "binary_name": "openjdk-17-jdk",
            "binary_version": "17.0.21.0.3+1-1~26.10.1"
        },
        {
            "binary_name": "openjdk-17-jdk-headless",
            "binary_version": "17.0.21.0.3+1-1~26.10.1"
        },
        {
            "binary_name": "openjdk-17-jre",
            "binary_version": "17.0.21.0.3+1-1~26.10.1"
        },
        {
            "binary_name": "openjdk-17-jre-headless",
            "binary_version": "17.0.21.0.3+1-1~26.10.1"
        },
        {
            "binary_name": "openjdk-17-jre-zero",
            "binary_version": "17.0.21.0.3+1-1~26.10.1"
        },
        {
            "binary_name": "openjdk-17-source",
            "binary_version": "17.0.21.0.3+1-1~26.10.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-10037.json"
openjdk-17-crac

Package

Name
openjdk-17-crac
Purl
pkg:deb/ubuntu/openjdk-17-crac?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

17.*
17.0.18+8-0ubuntu1
17.0.19+10-0ubuntu1
17.0.20+8-0ubuntu1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "openjdk-17-crac-demo",
            "binary_version": "17.0.20+8-0ubuntu1"
        },
        {
            "binary_name": "openjdk-17-crac-jdk",
            "binary_version": "17.0.20+8-0ubuntu1"
        },
        {
            "binary_name": "openjdk-17-crac-jdk-headless",
            "binary_version": "17.0.20+8-0ubuntu1"
        },
        {
            "binary_name": "openjdk-17-crac-jre",
            "binary_version": "17.0.20+8-0ubuntu1"
        },
        {
            "binary_name": "openjdk-17-crac-jre-headless",
            "binary_version": "17.0.20+8-0ubuntu1"
        },
        {
            "binary_name": "openjdk-17-crac-jre-zero",
            "binary_version": "17.0.20+8-0ubuntu1"
        },
        {
            "binary_name": "openjdk-17-crac-source",
            "binary_version": "17.0.20+8-0ubuntu1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-10037.json"
openjdk-21

Package

Name
openjdk-21
Purl
pkg:deb/ubuntu/openjdk-21?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

21.*
21.0.11~8ea-1
21.0.11+10-1
21.0.12~5ea-1
21.0.12+8-1
21.0.12.1+1-1
21.0.13.0.3+1-1~26.10.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "openjdk-21-demo",
            "binary_version": "21.0.13.0.3+1-1~26.10.1"
        },
        {
            "binary_name": "openjdk-21-jdk",
            "binary_version": "21.0.13.0.3+1-1~26.10.1"
        },
        {
            "binary_name": "openjdk-21-jdk-headless",
            "binary_version": "21.0.13.0.3+1-1~26.10.1"
        },
        {
            "binary_name": "openjdk-21-jre",
            "binary_version": "21.0.13.0.3+1-1~26.10.1"
        },
        {
            "binary_name": "openjdk-21-jre-headless",
            "binary_version": "21.0.13.0.3+1-1~26.10.1"
        },
        {
            "binary_name": "openjdk-21-jre-zero",
            "binary_version": "21.0.13.0.3+1-1~26.10.1"
        },
        {
            "binary_name": "openjdk-21-source",
            "binary_version": "21.0.13.0.3+1-1~26.10.1"
        },
        {
            "binary_name": "openjdk-21-testsupport",
            "binary_version": "21.0.13.0.3+1-1~26.10.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-10037.json"
openjdk-21-crac

Package

Name
openjdk-21-crac
Purl
pkg:deb/ubuntu/openjdk-21-crac?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

21.*
21.0.10+7-0ubuntu1
21.0.11+10-0ubuntu1
21.0.12+8-0ubuntu1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "openjdk-21-crac-demo",
            "binary_version": "21.0.12+8-0ubuntu1"
        },
        {
            "binary_name": "openjdk-21-crac-jdk",
            "binary_version": "21.0.12+8-0ubuntu1"
        },
        {
            "binary_name": "openjdk-21-crac-jdk-headless",
            "binary_version": "21.0.12+8-0ubuntu1"
        },
        {
            "binary_name": "openjdk-21-crac-jre",
            "binary_version": "21.0.12+8-0ubuntu1"
        },
        {
            "binary_name": "openjdk-21-crac-jre-headless",
            "binary_version": "21.0.12+8-0ubuntu1"
        },
        {
            "binary_name": "openjdk-21-crac-jre-zero",
            "binary_version": "21.0.12+8-0ubuntu1"
        },
        {
            "binary_name": "openjdk-21-crac-source",
            "binary_version": "21.0.12+8-0ubuntu1"
        },
        {
            "binary_name": "openjdk-21-crac-testsupport",
            "binary_version": "21.0.12+8-0ubuntu1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-10037.json"
openjdk-8

Package

Name
openjdk-8
Purl
pkg:deb/ubuntu/openjdk-8?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

Other
8u482-ga~us1-0ubuntu1
8u492-ga~us2-0ubuntu2
8u502-ga~us1-0ubuntu1
8u504-ga-1ubuntu1
8u512-b09~us1-0ubuntu1~26.*
8u512-b09~us1-0ubuntu1~26.10.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "openjdk-8-demo",
            "binary_version": "8u512-b09~us1-0ubuntu1~26.10.1"
        },
        {
            "binary_name": "openjdk-8-jdk",
            "binary_version": "8u512-b09~us1-0ubuntu1~26.10.1"
        },
        {
            "binary_name": "openjdk-8-jdk-headless",
            "binary_version": "8u512-b09~us1-0ubuntu1~26.10.1"
        },
        {
            "binary_name": "openjdk-8-jre",
            "binary_version": "8u512-b09~us1-0ubuntu1~26.10.1"
        },
        {
            "binary_name": "openjdk-8-jre-headless",
            "binary_version": "8u512-b09~us1-0ubuntu1~26.10.1"
        },
        {
            "binary_name": "openjdk-8-jre-zero",
            "binary_version": "8u512-b09~us1-0ubuntu1~26.10.1"
        },
        {
            "binary_name": "openjdk-8-source",
            "binary_version": "8u512-b09~us1-0ubuntu1~26.10.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-10037.json"
openjdk-lts

Package

Name
openjdk-lts
Purl
pkg:deb/ubuntu/openjdk-lts?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

11.*
11.0.30+7-1ubuntu1
11.0.31+11-1ubuntu2
11.0.32+9-1ubuntu1
11.0.32.1+1-1ubuntu1
11.0.32.1+1-1ubuntu2
11.0.33+9-1ubuntu1~26.10.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "openjdk-11-demo",
            "binary_version": "11.0.33+9-1ubuntu1~26.10.1"
        },
        {
            "binary_name": "openjdk-11-jdk",
            "binary_version": "11.0.33+9-1ubuntu1~26.10.1"
        },
        {
            "binary_name": "openjdk-11-jdk-headless",
            "binary_version": "11.0.33+9-1ubuntu1~26.10.1"
        },
        {
            "binary_name": "openjdk-11-jre",
            "binary_version": "11.0.33+9-1ubuntu1~26.10.1"
        },
        {
            "binary_name": "openjdk-11-jre-headless",
            "binary_version": "11.0.33+9-1ubuntu1~26.10.1"
        },
        {
            "binary_name": "openjdk-11-jre-zero",
            "binary_version": "11.0.33+9-1ubuntu1~26.10.1"
        },
        {
            "binary_name": "openjdk-11-source",
            "binary_version": "11.0.33+9-1ubuntu1~26.10.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-10037.json"