PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48831 WineHQ CVE debrief

Wine's .desktop file registers MIME handlers for Windows executable formats (EXE and others). When triggered, these handlers may execute files with the invoker's permissions, enabling sandbox escape from Flatpak and Snap environments. The issue stems from MIME handlers being invoked by file managers or browsers when users interact with executable files, rather than being restricted to intentional program launches. The CVE description notes that some parties consider this not a Wine bug, as alternative approaches like binfmt-misc lack cross-platform availability and would significantly degrade usability.

Vendor
WineHQ
Product
Wine
CVSS
HIGH 7.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-24
Original CVE updated
2026-05-26
Advisory published
2026-05-24
Advisory updated
2026-05-26

Who should care

Organizations using Wine within Flatpak or Snap sandboxes; multi-user Linux environments where unintended executable invocation poses security risk; security teams evaluating desktop file association policies.

Technical summary

Wine registers .desktop MIME handlers for Windows executables. File managers invoking these handlers execute EXE files with user permissions, breaking Flatpak/Snap isolation. No fix available due to cross-platform binfmt-misc limitations.

Defensive priority

high

Recommended defensive actions

  • Audit systems for Wine installations, particularly within Flatpak or Snap sandboxed environments
  • Review file manager and browser configurations to control automatic MIME handler invocation for executable file types
  • Consider restricting Wine .desktop file associations in multi-user or high-risk deployment scenarios
  • Monitor WineHQ bug tracker and distribution security advisories for future resolution status
  • Evaluate alternative containment strategies (e.g., dedicated VMs, separate user contexts) for Windows executable handling where sandbox escape risk is unacceptable

Evidence notes

NVD record shows Deferred status. WineHQ bug tracker reference confirms vendor awareness. OSS-security list discussions indicate community debate on fix feasibility. CVSS 4.0 vector indicates local attack vector with physical access requirement, no privileges required, user interaction needed, high impact to confidentiality/integrity/availability of victim resources. CWE-669 (Incorrect Resource Transfer Between Spheres) classified as secondary weakness.

Official resources

2026-05-24