CVE-2026-97027 — Flatpak: flatpak: denial of service via unsanitized keys in exported desktop entry / d-bus service files
Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.desktop) and D-Bus Service (.service) files, instead of validat…
Published: 2026-09-28 · CVSS: 3.6 · CVSS 3.1
Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.desktop) and D-Bus Service (.service) files, instead of validating against an allowlist. A malicious Flatpak app can use this to cause denial of service (e.g. forced application restart loops) or to influence host D-Bus/systemd activation behavior beyond what the sandbox is intended to permit.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7