Flatpak EUVD-2026-71774

Exploitation requires a local authenticated account with at least standard user (low) privileges on an affected RHEL system running Flatpak - the attacker must be able to invoke the Deploy() method on the org.freedesktop.Flatpak.SystemHelper D-Bus service, which is typically permitted to console or session users by default polkit policy. The attack further requires winning a timing-sensitive race condition (AC:H), meaning the attacker must be able to substitute a symlink in the filesystem path during the narrow gap between the privileged chmod and OSTree validation; this generally requires local process scheduling control or auxiliary timing techniques. Remote unauthenticated exploitation is not possible. The vulnerability does not apply to systems without Flatpak installed or where polkit has been configured to restrict Deploy() access.

The provided CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L) scores 5.8 (Medium), which accurately reflects the real-world constraint: exploitation requires a local, low-privileged account and the ability to win a timing-sensitive race condition, making reliable exploitation non-trivial. The C:H metric is significant - successfully redirecting the symlink could expose sensitive files readable only by root (e.g., /etc/shadow or private keys). However, AC:H genuinely limits practical exploitability; race conditions of this class typically require multiple attempts or auxiliary techniques (e.g., filesystem namespace manipulation via inotify or looping symlink swaps) to achieve consistent success. No EPSS data was provided, KEV status is negative, and no POC is publicly known, all of which reduce urgency. This vulnerability is best categorized as a medium-priority local privilege escalation risk on systems where untrusted local users have access, rather than a critical remote threat.

A local user with a standard shell account on an RHEL system repeatedly invokes the Flatpak Deploy() operation via the SystemHelper D-Bus interface while simultaneously swapping a symlink in the deployment path to point to /etc/shadow during the window between the privileged chmod call and OSTree validation. If the race is won, the chmod applies to /etc/shadow, potentially altering its permissions so the attacker can read the file and extract password hashes. No public POC exists at time of analysis, but the technique is well-understood and the inotify-assisted symlink race pattern is documented in prior Linux privilege escalation research.