Home / mailings

PDF

[USN-8256-1] opam vulnerability

Posted on 07 May 2026
Ubuntu Security

==========================================================================Ubuntu Security Notice USN-8256-1
May 07, 2026

opam vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 25.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

opam could be made to install files in unintended locations if it installed
a specially crafted package.

Software Description:
- opam: package manager for OCaml

Details:

Andrew Nesbitt discovered that opam did not properly validate file
destination paths in package install files. An attacker could use this
issue to bypass sandbox protections and write files to arbitrary locations,
possibly leading to arbitrary code execution.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
opam 2.5.0-1ubuntu0.1~esm1
Available with Ubuntu Pro
opam-installer 2.5.0-1ubuntu0.1~esm1
Available with Ubuntu Pro

Ubuntu 25.10
opam 2.3.0-1+deb13u1build0.25.10.1
opam-installer 2.3.0-1+deb13u1build0.25.10.1

Ubuntu 24.04 LTS
opam 2.1.5-1ubuntu0.1~esm2
Available with Ubuntu Pro
opam-installer 2.1.5-1ubuntu0.1~esm2
Available with Ubuntu Pro

Ubuntu 22.04 LTS
opam 2.1.2-1+deb12u1build0.22.04.1
opam-installer 2.1.2-1+deb12u1build0.22.04.1

Ubuntu 20.04 LTS
opam 2.0.5-1ubuntu1+esm1
Available with Ubuntu Pro
opam-installer 2.0.5-1ubuntu1+esm1
Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-8256-1
CVE-2026-41082

Package Information:
https://launchpad.net/ubuntu/+source/opam/2.3.0-1+deb13u1build0.25.10.1
https://launchpad.net/ubuntu/+source/opam/2.1.2-1+deb12u1build0.22.04.1

--===============1459956833911875947==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature

 

TOP