Flatpak forwards arbitrary vendor-extension keys unchanged when generating an application’s Desktop Entry (.desktop) and D‑Bus Service (.service) files, rather than filtering them against an allowlist. This flaw can lead a malicious Flatpak package to inject malformed entries that force the application into restart loops or alter host D‑Bus/systemd activation behavior, exceeding the sandbox’s intended restrictions. The impact is a denial of service to end users of the affected app, without elevating privileges or compromising sensitive data.

Red Hat Enterprise Linux 10, 7, 8, and 9, with the Flatpak package installed on those platforms. All versions of these operating systems that use a Flatpak runtime are susceptible, as the vulnerability resides in the Flatpak tool rather than a specific RHEL release.

The CVSS score of 3.6 classifies this issue as low severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation activity. The likely attack vector is local, requiring a malicious Flatpak application to be installed on the system; the attacker must bypass the normal trust chain of Flatpak repositories. Because the flaw only causes a service restart loop or unintended activation of D‑Bus or systemd units, an attacker with sufficient privileges to install Flatpak apps can execute it, but the risk of widespread exploitation remains modest.