Executable MIME handler risks

arraybolt3 · July 8, 2026, 9:42pm

Over the last few months, we (Patrick and I) have done a substantial amount of research into, and discussion with others about, the security risks of executable MIME handlers. This is a log of the discussions, posts, and CVEs related to this, several of which were discovered by us.

Initial thread on the oss-security mailing list with research findings, mostly focusing on the dangers introduced by installing Wine from WineHQ upstream: oss-security - On the issue of MIME handlers that execute arbitrary code (e.g. Wine)
CVE assigned to KDE’s Dolphin file manager, this was discovered by us, the issue has been patched: https://www.cve.org/CVERecord?id=CVE-2026-41525
Earlier thread on oss-security talking about a very similar (now fixed) issue in Debian’s Mono package: oss-security - Code execution through MIME-type association of Mono interpreter and security expectations of MIME type associations
CVE assigned for the Mono issue, not discovered by us, issue is patched: https://www.cve.org/CVERecord?id=CVE-2023-26314
Bug report against Ubuntu’s Java and Mailcap packages for a vulnerability discovered by us while writing the initial thread to oss-security: Bug #2153100 “.jar MIME handler allows escaping Firefox's Snap s...” : Bugs : openjdk-25 package : Ubuntu
Associated CVE, now fixed: https://www.cve.org/CVERecord?id=CVE-2026-10037
Follow-up thread on oss-security reporting a related issue in PCManFM-Qt: oss-security - PCManFM-Qt allows arbitrary files to be opened via the org.freedesktop.FileManager1.ShowFolders method
CVE assigned for PCManFM-Qt, issue discovered by us, this has not been patched but has been mitigated in Kicksecure: https://www.cve.org/CVERecord?id=CVE-2026-48700
Bug report to Wine for shipping an executable MIME handler: Making sure you're not a bot!
CVE for Wine, discovered by us, this has not been patched upstream, but Debian has a patch already that has been integrated for some years: https://www.cve.org/CVERecord?id=CVE-2026-48831
Email to XDG FreeDesktop mailing list proposing a spec change to separate executable MIME handlers from non-executable handlers: Fixing security issues with MIME handler registration in the Desktop Entry spec
More formal change proposal for the desktop file specification and ensuing discussion: Making sure you're not a bot!
Thread on fedora-devel mailing list discussing the issue: Making sure you're not a bot!

Further conversations about this should be edited into this post or posted underneath as new posts. (I think we traditionally do new posts, but I’d kind of like to use edits for this to keep all of the links in one place.)

Uplink · July 12, 2026, 6:37pm

How were these risks initially stumbled upon and what can be done to mitigate it?

arraybolt3 · July 12, 2026, 9:53pm

I was trying to find a RAM-efficient way of triggering PCManFM-Qt over D-Bus, ran into some weird behavior when launching it, mentioned it on the Whonix forums, then Qubes OS’s lead dev asked a question that led down a rabbit hole.

Many of the issues have been patched already, and the biggest one that isn’t patched (PCManFM-Qt) has been mitigated through a D-Bus shim in Kicksecure:

github.com/Kicksecure/security-misc

usr/src/security-misc/fm-shim-backend.c%23security-misc-shared

master

/*
 * Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org
 * See the file COPYING for copying conditions.
 */

/*
 * This is the backend half of an org.freedesktop.FileManager1 D-Bus interface
 * handler. It catches method calls intended for that interface, and executes
 * the frontend with arguments from the calls. This is intended to work around
 * issues with PCManFM-Qt's D-Bus handling.
 *
 * Notes for reviewers:
 *
 * - Local denial-of-service is out of scope. There are easier ways for
 *   malware to pop up lots of windows or consume huge amounts of RAM.
 * - The environment from systemd's user manager is considered trusted.
 *   Attackers that can modify its environment via D-Bus can set
 *   LD_LIBRARY_PATH in the user manager, which cannot be meaningfully
 *   defended against.
 * - The program intentionally return a "success" D-Bus reply even if no

This file has been truncated. show original

github.com/Kicksecure/security-misc

usr/lib/python3/dist-packages/fm_shim_frontend/fm_shim_frontend.py%23security-misc-shared

master

#!/usr/bin/python3 -su

## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

# pylint: disable=broad-exception-caught

## Notes for reviewers:
##
## * Local denial-of-service is out of scope. There are easier ways for
##   malware to pop up lots of windows or consume huge amounts of RAM.
## * The shim's primary purpose is to ensure that files aren't accidentally
##   opened when trying to view the contents of a directory. We do not care if
##   the exact directory that exists at launch time is the directory that gets
##   opened when the user chooses to open it. Therefore replacement attacks
##   involving swapping one directory with another or with a symlink to a
##   directory are out of scope.
## * Python version lower than 3.13.5 are out of scope.

"""

This file has been truncated. show original

The next largest unpatched one is Wine. For that, the best mitigation is, don’t install Wine from WineHQ. (Maybe we should add a systemcheck test to see if WineHQ’s repos are enabled and warn if so…)