Flatpak improperly validates vendor-extension keys when exporting an application's Desktop Entry (.desktop) and D-Bus Service (.service) files, allowing a malicious Flatpak app to pass arbitrary keys unmodified. This can lead to denial of service by causing forced application restart loops or by influencing host D-Bus/systemd activation behavior outside the sandbox's intended scope. Exploitation requires a user to install and run a malicious Flatpak application, with no additional privileges needed. The vulnerability affects Red Hat Enterprise Linux 10 as per Red Hat's advisory. The CVSS vector is AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L, indicating local attack vector, low complexity, no privileges required, user interaction required, scope change, no confidentiality or integrity impact, and low availability impact.

The vulnerability can cause denial of service conditions such as forced application restart loops or disruption of service activation on the host system. There is no impact on confidentiality or integrity. Exploitation requires local user interaction to install and run a malicious Flatpak application. The scope of impact extends beyond the Flatpak sandbox to the host session's D-Bus/systemd activation behavior.

Red Hat advises only installing Flatpak applications from trusted sources to mitigate this vulnerability. There is no official fix or patch status provided in the advisory at this time. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-97027 for current remediation guidance.