CVE-2024-32462 affects Flatpak, a Linux sandboxing system for desktop applications. In affected versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app can escape its sandbox by exploiting the --command argument of flatpak run. Specifically, it is possible to pass bubblewrap (bwrap) arguments such as --bind through the portal interface org.freedesktop.portal.Background.RequestBackground, which converts these into commands that bypass sandbox restrictions. The vulnerability is mitigated by ensuring bwrap stops processing options after a -- argument, a feature supported since bubblewrap 0.3.0, and by xdg-desktop-portal 1.18.4 restricting command creation. Red Hat has issued patches for affected versions, and the vulnerability is tracked under RHSA-2024:3980.

A malicious or compromised Flatpak application can execute arbitrary code outside its intended sandbox environment, potentially leading to full system compromise or unauthorized access to system resources. This breaks the core security guarantees of Flatpak sandboxing. The CVSS 3.1 base score is 8.4, indicating high impact on confidentiality and integrity with low attack complexity and no user interaction required.

A patch is available and should be applied by upgrading Flatpak to versions 1.10.9, 1.12.9, 1.14.6, or 1.15.8 or later. Additionally, upgrading xdg-desktop-portal to version 1.18.4 or later mitigates the vulnerability by restricting command creation. Red Hat Enterprise Linux 7 users should apply the security update RHSA-2024:3980. No further action is required beyond applying these official fixes.