Which versions of Wine are affected by CVE-2026-48831?

Wine versions 0.9-11.0 contain a sandbox escape vulnerability affecting organizations using Wine within Flatpak or Snap containerized environments; successful exploitation allows attackers to break…

How to fix or mitigate CVE-2026-48831?

Within 24 hours, identify all systems running Wine versions 0.9-11.0 inside Flatpak or Snap containers and assess user exposure to untrusted executable files. Within 7 days, disable Wine MIME handler registration for .EXE and Windows executable file types on affected systems; implement endpoint monitoring to detect Wine child process execution; and provide users with alternative workflows for required Windows application access. Within 30 days, evaluate architectural alternatives to Wine sandboxing, monitor Wine upstream releases for security patches that address this issue, and conduct security awareness training on the risks of opening untrusted files.

Wine CVE-2026-48831

Q: What is the CVSS score of CVE-2026-48831?

CVE-2026-48831 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:Clear. EPSS exploitation probability: 0.0%.

EUVD-2026-31599 HIGH

Incorrect Resource Transfer Between Spheres (CWE-669)

2026-05-24 mitre

GHSA-h8w5-58rh-75vr

Information Disclosure Microsoft Wine Winehq

7.3

CVSS 4.0 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.3 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:Clear

vuln.today AI

8.6 HIGH

Local and user-opened file (AV:L/UI:R) with no prior privileges (PR:N); escaping the Flatpak/Snap sandbox crosses a security boundary (S:C) and yields full code execution (C/I/A:H).

3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:24 vuln.today

CVE Published

May 24, 2026 - 20:52 cve.org

HIGH 7.3

CVE Published

May 24, 2026 - 20:52 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Wine ships a .desktop file that registers itself as a MIME handler for EXE files and several other Windows executable file types. In some configurations, handling of an EXE file causes that file to be blindly executed with the permissions of the invoker. This allows escaping Flatpak and Snap sandboxes, because MIME handlers are not intended for use by code interpreters and loaders. NOTE: some parties feel that this is not a bug to be addressed in Wine, because there is no known solution that avoids a severe loss of usability (Wine could be a binfmt-misc handler, but binfmt-misc does not exist on all platforms supported by Wine).

AnalysisAI

Sandbox escape in Wine (versions 0.9 through 11.0) arises because Wine installs a .desktop entry that registers itself as the MIME handler for EXE and other Windows executable types, so opening such a file causes it to be executed with the invoker's permissions. Because MIME handlers are treated as trusted for user-launched documents, an attacker who gets an EXE handled inside a Flatpak or Snap confinement can break out of that sandbox and run code with the user's normal privileges. This is a disputed issue with no public exploit identified at time of analysis, a very low EPSS (0.02%), and no CISA KEV listing; maintainers argue no fix exists without a severe usability loss.

Technical ContextAI

The flaw sits in Wine's desktop integration on freedesktop.org (XDG) Linux environments. Wine ships a .desktop file that claims MIME associations such as application/x-ms-dos-executable and related Windows PE types, making Wine the default 'open with' handler for EXE/DLL-style files. Under CWE-669 (Incorrect Resource Transfer Between Spheres), untrusted data crossing from a low-privilege/confined sphere (a file inside a Flatpak or Snap sandbox) is transferred to a higher-trust execution sphere: the XDG MIME/portal machinery invokes Wine outside the sandbox, and Wine loads and runs the PE binary. The core problem is that a code interpreter/loader (Wine) is wired into the MIME-handler path, which is designed for opening documents, not for executing arbitrary code. Affected products per CPE are cpe:2.3:a:winehq:wine across all versions in the stated range.

RemediationAI

No vendor-released patch identified at time of analysis; the issue is disputed and Wine maintainers state there is no known fix that avoids a severe usability loss (a binfmt-misc handler was suggested but binfmt-misc is not available on all Wine-supported platforms). As concrete compensating controls, remove or neutralize Wine's EXE MIME association so it is no longer the default handler - for example delete or edit the Wine .desktop entry and update the MIME defaults (via xdg-mime / mimeapps.list) so Windows-executable MIME types are not auto-opened by Wine; the trade-off is that double-clicking EXE files will no longer launch them through Wine and users must invoke Wine explicitly. Where Wine is delivered via Flatpak/Snap, tighten the portal/filesystem permissions so sandboxed content cannot invoke the host Wine handler, accepting reduced 'open with Wine' convenience. Monitor the WineHQ bug (https://bugs.winehq.org/show_bug.cgi?id=59767) and oss-security threads (https://www.openwall.com/lists/oss-security/2026/05/19/1) for any future upstream decision. Treat MIME-driven auto-execution of EXE files as untrusted and require explicit user action to run Windows binaries.