# CVE-2024-32462: flatpak: Flatpak is a system for building, distributing, and running sandboxeddesktop applications on Linux CVE-2024-32462 is fixed in 15 products on 1 platform, first by flatpak 1.14.6-1, released April 18, 2024. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2024-32462 - Priority: High - CVSS: 8.4 (Medium) - EPSS: 0.0051 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Apr 18, 2024 ## Description Flatpak is a system for building, distributing, and running sandboxeddesktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6,and 1.15.8, a malicious or compromised Flatpak app could execute arbitrarycode outside its sandbox. Normally, the `--command` argument of `flatpakrun` expects to be given a command to run in the specified Flatpak app,optionally along with some arguments. However it is possible to insteadpass `bwrap` arguments to `--command=`, such as `--bind`. It's possible topass an arbitrary `commandline` to the portal interface`org.freedesktop.portal.Background.RequestBackground` from within a Flatpakapp. When this is converted into a `--command` and arguments, it achievesthe same effect of passing arguments directly to `bwrap`, and thus can beused for a sandbox escape. The solution is to pass the `--` argument to`bwrap`, which makes it stop processing options. This has been supportedsince bubblewrap 0.3.0. All supported versions of Flatpak require at leastthat version of bubblewrap. xdg-desktop-portal version 1.18.4 will mitigatethis vulnerability by only allowing Flatpak apps to create .desktop filesfor commands that do not start with --. The vulnerability is patched in1.15.8, 1.10.9, 1.12.9, and 1.14.6. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | bubblewrap opensuse-leap 15.6 | 0.11.0-150500.3.9.1 | [SUSE-RU-2025:0145-1](https://patchblox.com/security/data/fix/linux/suse-ru-2025-0145-1.md) | Jan 16, 2025 | | Linux | bubblewrap sles 15.6 | 0.11.0-150500.3.9.1 | [SUSE-RU-2025:0145-1](https://patchblox.com/security/data/fix/linux/suse-ru-2025-0145-1.md) | Jan 16, 2025 | | Linux | flatpak Debian 11.6 (bullseye) | 1.10.8-0+deb11u2 | [DSA-5666-1](https://patchblox.com/security/data/fix/linux/dsa-5666-1.md) | Apr 19, 2024 | | Linux | flatpak Debian 12.15 (bookworm) | 1.14.4-1+deb12u1 | [DSA-5666-1](https://patchblox.com/security/data/fix/linux/dsa-5666-1.md) | Apr 19, 2024 | | Linux | flatpak Debian 13.5 (trixie) | 1.14.6-1 | [DEBIAN-CVE-2024-32462](https://patchblox.com/security/data/fix/linux/debian-cve-2024-32462.md) | Apr 18, 2024 | | Linux | flatpak Debian 14 | 1.14.6-1 | [DEBIAN-CVE-2024-32462](https://patchblox.com/security/data/fix/linux/debian-cve-2024-32462.md) | Apr 18, 2024 | | Linux | flatpak RHEL 8 | 0:1.12.9-1.el8_10 | [RHSA-2024:3961](https://patchblox.com/security/data/fix/linux/rhsa-2024-3961.md) | Jun 17, 2024 | | Linux | flatpak RHEL 9 | 0:1.12.9-1.el9_4 | [RHSA-2024:3959](https://patchblox.com/security/data/fix/linux/rhsa-2024-3959.md) | Jun 17, 2024 | | Linux | flatpak Ubuntu 24.04.5 LTS (noble) | 1.14.6-1 | [flatpak 1.14.6-1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-flatpak-1.14.6-1.md) | Apr 18, 2024 | | Linux | flatpak Ubuntu 24.10 (oracular) | 1.14.6-1 | [flatpak 1.14.6-1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-flatpak-1.14.6-1.md) | Jan 16, 2026 | | Linux | flatpak Ubuntu 25.04 (plucky) | 1.14.6-1 | [flatpak 1.14.6-1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-flatpak-1.14.6-1.md) | Jan 16, 2026 | | Linux | flatpak almalinux 8 | 1.12.9-1.el8_10 | [ALSA-2024:3961](https://patchblox.com/security/data/fix/linux/alsa-2024-3961.md) | Jun 17, 2024 | | Linux | flatpak almalinux 9 | 1.12.9-1.el9_4 | [ALSA-2024:3959](https://patchblox.com/security/data/fix/linux/alsa-2024-3959.md) | Jun 17, 2024 | | Linux | flatpak amzn 2023 | 1.15.4-3.amzn2023.0.2 | [ALAS2023-2024-611](https://patchblox.com/security/data/fix/linux/alas2023-2024-611.md) | May 9, 2024 | | Linux | flatpak ol 8 | 0:1.12.9-1.el8_10 | [ELSA-2024-3961](https://patchblox.com/security/data/fix/linux/elsa-2024-3961.md) | Jun 17, 2024 | | Linux | flatpak ol 9 | 0:1.12.9-1.el9_4 | [ELSA-2024-3959](https://patchblox.com/security/data/fix/linux/elsa-2024-3959.md) | Jun 17, 2024 | | Linux | flatpak opensuse-leap 15.6 | 1.16.0-150600.3.6.1 | [SUSE-RU-2025:0145-1](https://patchblox.com/security/data/fix/linux/suse-ru-2025-0145-1.md) | Jan 16, 2025 | | Linux | flatpak rocky 8 | 0:1.12.9-1.el8_10 | [RLSA-2024:3961](https://patchblox.com/security/data/fix/linux/rlsa-2024-3961.md) | Jul 2, 2024 | | Linux | flatpak rocky 9 | 0:1.12.9-1.el9_4 | [RLSA-2024:3959](https://patchblox.com/security/data/fix/linux/rlsa-2024-3959.md) | Jul 2, 2024 | | Linux | flatpak sles 15.6 | 1.16.0-150600.3.6.1 | [SUSE-RU-2025:0145-1](https://patchblox.com/security/data/fix/linux/suse-ru-2025-0145-1.md) | Jan 16, 2025 | | Linux | flatpak-debuginfo amzn 2023 | 1.15.4-3.amzn2023.0.2 | [ALAS2023-2024-611](https://patchblox.com/security/data/fix/linux/alas2023-2024-611.md) | May 9, 2024 | | Linux | flatpak-debugsource amzn 2023 | 1.15.4-3.amzn2023.0.2 | [ALAS2023-2024-611](https://patchblox.com/security/data/fix/linux/alas2023-2024-611.md) | May 9, 2024 | | Linux | flatpak-devel RHEL 8 | 0:1.12.9-1.el8_10 | [RHSA-2024:3961](https://patchblox.com/security/data/fix/linux/rhsa-2024-3961.md) | Jun 17, 2024 | | Linux | flatpak-devel RHEL 9 | 0:1.12.9-1.el9_4 | [RHSA-2024:3959](https://patchblox.com/security/data/fix/linux/rhsa-2024-3959.md) | Jun 17, 2024 | | Linux | flatpak-devel almalinux 8 | 1.12.9-1.el8_10 | [ALSA-2024:3961](https://patchblox.com/security/data/fix/linux/alsa-2024-3961.md) | Jun 17, 2024 | | Linux | flatpak-devel almalinux 9 | 1.12.9-1.el9_4 | [ALSA-2024:3959](https://patchblox.com/security/data/fix/linux/alsa-2024-3959.md) | Jun 17, 2024 | | Linux | flatpak-devel amzn 2023 | 1.15.4-3.amzn2023.0.2 | [ALAS2023-2024-611](https://patchblox.com/security/data/fix/linux/alas2023-2024-611.md) | May 9, 2024 | | Linux | flatpak-devel ol 8 | 0:1.12.9-1.el8_10 | [ELSA-2024-3961](https://patchblox.com/security/data/fix/linux/elsa-2024-3961.md) | Jun 17, 2024 | | Linux | flatpak-devel ol 9 | 0:1.12.9-1.el9_4 | [ELSA-2024-3959](https://patchblox.com/security/data/fix/linux/elsa-2024-3959.md) | Jun 17, 2024 | | Linux | flatpak-libs RHEL 8 | 0:1.12.9-1.el8_10 | [RHSA-2024:3961](https://patchblox.com/security/data/fix/linux/rhsa-2024-3961.md) | Jun 17, 2024 | | Linux | flatpak-libs RHEL 9 | 0:1.12.9-1.el9_4 | [RHSA-2024:3959](https://patchblox.com/security/data/fix/linux/rhsa-2024-3959.md) | Jun 17, 2024 | | Linux | flatpak-libs almalinux 8 | 1.12.9-1.el8_10 | [ALSA-2024:3961](https://patchblox.com/security/data/fix/linux/alsa-2024-3961.md) | Jun 17, 2024 | | Linux | flatpak-libs almalinux 9 | 1.12.9-1.el9_4 | [ALSA-2024:3959](https://patchblox.com/security/data/fix/linux/alsa-2024-3959.md) | Jun 17, 2024 | | Linux | flatpak-libs amzn 2023 | 1.15.4-3.amzn2023.0.2 | [ALAS2023-2024-611](https://patchblox.com/security/data/fix/linux/alas2023-2024-611.md) | May 9, 2024 | | Linux | flatpak-libs ol 8 | 0:1.12.9-1.el8_10 | [ELSA-2024-3961](https://patchblox.com/security/data/fix/linux/elsa-2024-3961.md) | Jun 17, 2024 | | Linux | flatpak-libs ol 9 | 0:1.12.9-1.el9_4 | [ELSA-2024-3959](https://patchblox.com/security/data/fix/linux/elsa-2024-3959.md) | Jun 17, 2024 | | Linux | flatpak-libs-debuginfo amzn 2023 | 1.15.4-3.amzn2023.0.2 | [ALAS2023-2024-611](https://patchblox.com/security/data/fix/linux/alas2023-2024-611.md) | May 9, 2024 | | Linux | flatpak-selinux RHEL 8 | 0:1.12.9-1.el8_10 | [RHSA-2024:3961](https://patchblox.com/security/data/fix/linux/rhsa-2024-3961.md) | Jun 17, 2024 | | Linux | flatpak-selinux RHEL 9 | 0:1.12.9-1.el9_4 | [RHSA-2024:3959](https://patchblox.com/security/data/fix/linux/rhsa-2024-3959.md) | Jun 17, 2024 | | Linux | flatpak-selinux almalinux 8 | 1.12.9-1.el8_10 | [ALSA-2024:3961](https://patchblox.com/security/data/fix/linux/alsa-2024-3961.md) | Jun 17, 2024 | | Linux | flatpak-selinux almalinux 9 | 1.12.9-1.el9_4 | [ALSA-2024:3959](https://patchblox.com/security/data/fix/linux/alsa-2024-3959.md) | Jun 17, 2024 | | Linux | flatpak-selinux amzn 2023 | 1.15.4-3.amzn2023.0.2 | [ALAS2023-2024-611](https://patchblox.com/security/data/fix/linux/alas2023-2024-611.md) | May 9, 2024 | | Linux | flatpak-selinux ol 8 | 0:1.12.9-1.el8_10 | [ELSA-2024-3961](https://patchblox.com/security/data/fix/linux/elsa-2024-3961.md) | Jun 17, 2024 | | Linux | flatpak-selinux ol 9 | 0:1.12.9-1.el9_4 | [ELSA-2024-3959](https://patchblox.com/security/data/fix/linux/elsa-2024-3959.md) | Jun 17, 2024 | | Linux | flatpak-session-helper RHEL 8 | 0:1.12.9-1.el8_10 | [RHSA-2024:3961](https://patchblox.com/security/data/fix/linux/rhsa-2024-3961.md) | Jun 17, 2024 | | Linux | flatpak-session-helper RHEL 9 | 0:1.12.9-1.el9_4 | [RHSA-2024:3959](https://patchblox.com/security/data/fix/linux/rhsa-2024-3959.md) | Jun 17, 2024 | | Linux | flatpak-session-helper almalinux 8 | 1.12.9-1.el8_10 | [ALSA-2024:3961](https://patchblox.com/security/data/fix/linux/alsa-2024-3961.md) | Jun 17, 2024 | | Linux | flatpak-session-helper almalinux 9 | 1.12.9-1.el9_4 | [ALSA-2024:3959](https://patchblox.com/security/data/fix/linux/alsa-2024-3959.md) | Jun 17, 2024 | | Linux | flatpak-session-helper amzn 2023 | 1.15.4-3.amzn2023.0.2 | [ALAS2023-2024-611](https://patchblox.com/security/data/fix/linux/alas2023-2024-611.md) | May 9, 2024 | | Linux | flatpak-session-helper ol 8 | 0:1.12.9-1.el8_10 | [ELSA-2024-3961](https://patchblox.com/security/data/fix/linux/elsa-2024-3961.md) | Jun 17, 2024 | | Linux | flatpak-session-helper ol 9 | 0:1.12.9-1.el9_4 | [ELSA-2024-3959](https://patchblox.com/security/data/fix/linux/elsa-2024-3959.md) | Jun 17, 2024 | | Linux | flatpak-session-helper-debuginfo amzn 2023 | 1.15.4-3.amzn2023.0.2 | [ALAS2023-2024-611](https://patchblox.com/security/data/fix/linux/alas2023-2024-611.md) | May 9, 2024 | | Linux | flatpak-tests Ubuntu 24.04.5 LTS (noble) | 1.14.6-1 | [flatpak-tests 1.14.6-1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-flatpak-tests-1.14.6-1.md) | Apr 18, 2024 | | Linux | flatpak-tests Ubuntu 24.10 (oracular) | 1.14.6-1 | [flatpak-tests 1.14.6-1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-flatpak-tests-1.14.6-1.md) | Jan 16, 2026 | | Linux | flatpak-tests Ubuntu 25.04 (plucky) | 1.14.6-1 | [flatpak-tests 1.14.6-1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-flatpak-tests-1.14.6-1.md) | Jan 16, 2026 | | Linux | flatpak-tests amzn 2023 | 1.15.4-3.amzn2023.0.2 | [ALAS2023-2024-611](https://patchblox.com/security/data/fix/linux/alas2023-2024-611.md) | May 9, 2024 | | Linux | flatpak-tests-debuginfo amzn 2023 | 1.15.4-3.amzn2023.0.2 | [ALAS2023-2024-611](https://patchblox.com/security/data/fix/linux/alas2023-2024-611.md) | May 9, 2024 | | Linux | gir1.2-flatpak-1.0 Ubuntu 24.04.5 LTS (noble) | 1.14.6-1 | [gir1.2-flatpak-1.0 1.14.6-1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-gir1.2-flatpak-1.0-1.14.6-1.md) | Apr 18, 2024 | | Linux | gir1.2-flatpak-1.0 Ubuntu 24.10 (oracular) | 1.14.6-1 | [gir1.2-flatpak-1.0 1.14.6-1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-gir1.2-flatpak-1.0-1.14.6-1.md) | Jan 16, 2026 | | Linux | gir1.2-flatpak-1.0 Ubuntu 25.04 (plucky) | 1.14.6-1 | [gir1.2-flatpak-1.0 1.14.6-1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-gir1.2-flatpak-1.0-1.14.6-1.md) | Jan 16, 2026 | | Linux | libflatpak0 Ubuntu 24.04.5 LTS (noble) | 1.14.6-1 | [libflatpak0 1.14.6-1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libflatpak0-1.14.6-1.md) | Apr 18, 2024 | | Linux | libflatpak0 Ubuntu 24.10 (oracular) | 1.14.6-1 | [libflatpak0 1.14.6-1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libflatpak0-1.14.6-1.md) | Jan 16, 2026 | | Linux | libflatpak0 Ubuntu 25.04 (plucky) | 1.14.6-1 | [libflatpak0 1.14.6-1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libflatpak0-1.14.6-1.md) | Jan 16, 2026 | | Linux | xdg-desktop-portal opensuse-leap 15.6 | 1.18.2-150600.4.3.1 | [SUSE-SU-2024:2067-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-2067-1.md) | Jun 18, 2024 | | Linux | xdg-desktop-portal sles 15.6 | 1.18.2-150600.4.3.1 | [SUSE-SU-2024:2067-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-2067-1.md) | Jun 18, 2024 | --- Data as of 2026-11-12T01:51:14Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.