DEBIAN-CVE-2026-48831
Wine ships a .desktop file that registers itself as a MIME handler for EXE files and several other Windows executable file types. In some configurations, handling of an EXE file causes that file to be blindly executed with the permissions of the invoker. This allows escaping Flatpak and Snap sandboxes, because MIME handlers are not intended for use by code interpreters and loaders. NOTE: some parties feel that this is not a bug to be addressed in Wine, because there is no known solution that avoids a severe loss of usability (Wine could be a binfmt-misc handler, but binfmt-misc does not exist on all platforms supported by Wine).
DEBIAN-CVE-2026-48831
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-48831
wine
Source reference: /affected/0/package/name
- Affected versions
- 10.0~rc1~repack-1
Source reference:
/affected/0/versions10.0~rc2~repack-1Source reference:
/affected/0/versions10.0~rc2~repack-2Source reference:
/affected/0/versions10.0~rc2~repack-3Source reference:
/affected/0/versions10.0~rc2~repack-4Source reference:
/affected/0/versions10.0~repack-1Source reference:
/affected/0/versions10.0~repack-10Source reference:
/affected/0/versions10.0~repack-11Source reference:
/affected/0/versions10.0~repack-12Source reference:
/affected/0/versions10.0~repack-2Source reference:
/affected/0/versions10.0~repack-3Source reference:
/affected/0/versions10.0~repack-4Source reference:
/affected/0/versions10.0~repack-5Source reference:
/affected/0/versions10.0~repack-6Source reference:
/affected/0/versions10.0~repack-7Source reference:
/affected/0/versions10.0~repack-8Source reference:
/affected/0/versions10.0~repack-9Source reference:
/affected/0/versions8.0.1~repack-1Source reference:
/affected/0/versions8.0.1~repack-2Source reference:
/affected/0/versions8.0.1~repack-3Source reference:
/affected/0/versions8.0.2~repack-1Source reference:
/affected/0/versions8.0.2~repack-2Source reference:
/affected/0/versions8.0~repack-4Source reference:
/affected/0/versions9.0~repack-1Source reference:
/affected/0/versions9.0~repack-2Source reference:
/affected/0/versions9.0~repack-3Source reference:
/affected/0/versions9.0~repack-4Source reference:
/affected/0/versions9.0~repack-5Source reference:
/affected/0/versions9.0~repack-6Source reference:
/affected/0/versions9.0~repack-7Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
wine
Source reference: /affected/1/package/name
- Affected versions
- 10.0~repack-10
Source reference:
/affected/1/versions10.0~repack-11Source reference:
/affected/1/versions10.0~repack-12Source reference:
/affected/1/versions10.0~repack-6Source reference:
/affected/1/versions10.0~repack-7Source reference:
/affected/1/versions10.0~repack-8Source reference:
/affected/1/versions10.0~repack-9Source reference:
/affected/1/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wine",
"purl": "pkg:deb/debian/wine?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"10.0~rc1~repack-1",
"10.0~rc2~repack-1",
"10.0~rc2~repack-2",
"10.0~rc2~repack-3",
"10.0~rc2~repack-4",
"10.0~repack-1",
"10.0~repack-10",
"10.0~repack-11",
"10.0~repack-12",
"10.0~repack-2",
"10.0~repack-3",
"10.0~repack-4",
"10.0~repack-5",
"10.0~repack-6",
"10.0~repack-7",
"10.0~repack-8",
"10.0~repack-9",
"8.0.1~repack-1",
"8.0.1~repack-2",
"8.0.1~repack-3",
"8.0.2~repack-1",
"8.0.2~repack-2",
"8.0~repack-4",
"9.0~repack-1",
"9.0~repack-2",
"9.0~repack-3",
"9.0~repack-4",
"9.0~repack-5",
"9.0~repack-6",
"9.0~repack-7"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-48831.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wine",
"purl": "pkg:deb/debian/wine?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"10.0~repack-10",
"10.0~repack-11",
"10.0~repack-12",
"10.0~repack-6",
"10.0~repack-7",
"10.0~repack-8",
"10.0~repack-9"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-48831.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #57202 · Revision 1
- Added to Heist Feed
- Publisher date