CVE-2026-10037

{
  "id": "CVE-2026-10037",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-08T22:17:12.500",
  "lastModified": "2026-10-25T17:10:00.197",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de escape de sandbox en los paquetes OpenJDK proporcionados en Ubuntu. Los gestores MIME de .jar instalados por estos paquetes ejecutan archivos marcados como ejecutables cuando el paquete mailcap está instalado. Una aplicación en sandbox comprometida o maliciosa con acceso al portal OpenURI a través de xdg-desktop-portal-gtk puede escribir un archivo .jar malicioso en el sistema de archivos del host, establecer su bit ejecutable y activar el gestor para ejecutar código arbitrario fuera del entorno de sandbox."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Canonical",
          "product": "Ubuntu",
          "defaultStatus": "unaffected",
          "packageName": "openjdk-8"
        },
        {
          "vendor": "Canonical",
          "product": "Ubuntu",
          "defaultStatus": "unaffected",
          "packageName": "openjdk-9"
        },
        {
          "vendor": "Canonical",
          "product": "Ubuntu",
          "defaultStatus": "unaffected",
          "packageName": "openjdk-13"
        },
        {
          "vendor": "Canonical",
          "product": "Ubuntu",
          "defaultStatus": "unaffected",
          "packageName": "openjdk-16"
        },
        {
          "vendor": "Canonical",
          "product": "Ubuntu",
          "defaultStatus": "unaffected",
          "packageName": "openjdk-17"
        },
        {
          "vendor": "Canonical",
          "product": "Ubuntu",
          "defaultStatus": "unaffected",
          "packageName": "openjdk-18"
        },
        {
          "vendor": "Canonical",
          "product": "Ubuntu",
          "defaultStatus": "unaffected",
          "packageName": "openjdk-21"
        },
        {
          "vendor": "Canonical",
          "product": "Ubuntu",
          "defaultStatus": "unaffected",
          "packageName": "openjdk-25"
        },
        {
          "vendor": "Canonical",
          "product": "Ubuntu",
          "defaultStatus": "unaffected",
          "packageName": "openjdk-lts"
        },
        {
          "vendor": "Canonical",
          "product": "Ubuntu",
          "defaultStatus": "unaffected",
          "packageName": "mailcap",
          "versions": [
            {
              "version": "0",
              "lessThan": "3.70+nmu1ubuntu1.22.04.1",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "3.70+nmu1ubuntu1.24.04.1",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "3.74ubuntu1.1",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "3.75ubuntu1.1",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-10T03:55:37.353524Z",
          "id": "CVE-2026-10037",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://bugs.launchpad.net/ubuntu/+source/openjdk-25/+bug/2153100",
      "source": "[email protected]"
    }
  ]
}