Hi Simon, On Fri, Jul 24, 2026 at 03:08:18PM +0100, Simon McVittie wrote: > On Fri, 24 Jul 2026 at 15:37:42 +0200, Salvatore Bonaccorso wrote: > > | A heap-based buffer overflow can be > > | triggered [...] when an attacker- > > | controlled MIME magic file in a user-writable XDG data location > > | (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed > > I'm having a hard time thinking of reasons why this would be crossing a > security boundary: if a program has the ability to write to $XDG_DATA_HOME > then it's already part of the trusted computing base for this user (for > example it could configure `systemd --user` to run arbitrary code), and I > can't think of a reason why it would be desirable to let untrusted/sandboxed > software write to $XDG_DATA_HOME/mime/magic, which would let that software > change the rules by which files are classified into their MIME types. > > (Flatpak apps can export a file into XDG_DATA_HOME/mime/packages, but not > into .../magic.)
I highly appreciate that you took time to do an assessment here, given the amount of incoming CVEs the primarily focus here was to first report the new one to the maintainers and do an assessment on the severity later. I will mark the CVE as no-dsa and guess you will agree on it. Regards, Salvatore
