CVE-2026-92162 flatpak CVE debrief

Who should care

System administrators and security teams responsible for Linux systems, especially those using Flatpak with OCI remotes configured, should assess exposure and prioritize upgrading to version 1.18.1 or later.

Why it matters

This vulnerability in Flatpak allows a local user to potentially escalate privileges to root when combined with other vulnerabilities, making it a high priority for systems with OCI remotes configured.

• Potential local root privilege escalation when combined with other vulnerabilities.
• Possible creation of root-owned directory trees with arbitrary contents.
• Increased risk for systems with OCI remotes configured, especially on Fedora systems.
• Verification of Flatpak version and OCI remote configuration is necessary.

Technical summary

The vulnerability exists in Flatpak prior to version 1.18.1, allowing a malicious local user to create a root-owned directory tree with contents determined by the OCI remote via unvalidated 'arch' parameters. This vulnerability can be combined with other vulnerabilities to lead to local root privilege escalation. The vulnerability is not believed to be exploitable if there are no OCI remotes configured (common on non-Fedora systems). A malicious local user in an active local session could use a crafted architecture name to trick the `flatpak-system-helper` process into creating a root-owned directory tree with contents determined by the OCI remote, plus a root-owned `lock` file and `icons` directory, outside of

Defensive priority

High priority for systems with OCI remotes configured, especially on Fedora systems.

Recommended defensive actions

• Assess exposure for systems with OCI remotes configured, especially on Fedora systems.
• Verify if systems are running Flatpak versions prior to 1.18.1.
• Upgrade to Flatpak version 1.18.1 or later.
• Monitor for suspicious activity related to Flatpak and OCI remotes.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability exists in Flatpak prior to version 1.18.1. A malicious local user in an active local session could exploit this vulnerability to create a root-owned directory tree with contents determined by the OCI remote.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.