CVE-2026-34079

A flaw was found in Flatpak, a Linux application sandboxing and distribution framework. The caching mechanism for ld.so (dynamic linker/loader) improperly removes outdated cache files without adequately verifying that the application-controlled path to the outdated cache is within the designated cache directory. This vulnerability allows Flatpak applications to delete arbitrary files on the host system, potentially leading to system instability or data loss.

The CVE has been rated as moderate by Red Hat for multiple reasons. The vulnerability can only be exploited by executing a malicious Flatpak application on the local system. The attacker must already have the ability to: provide a Flatpak package to the victim, and have the victim install/run it locally. The attacker must execute a Flatpak application under a valid user account; hence privilage required is low. A victim must: install,trust,or launch the malicious Flatpak application. Without user interaction, the exploit cannot occur because the attacker cannot independently trigger execution of the malicious package.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.