CVE-2026-123784
Description
A flaw was found in Fluxbox. This vulnerability allows an attacker to execute arbitrary commands by convincing a user to load a specially crafted style file. When processing the style, unescaped background configuration values are passed directly to a system shell command, leading to command execution with the privileges of the victim.
Statement
This vulnerability is rated as an Important severity flaw because successful exploitation allows arbitrary command execution with the privileges of the logged-in user without requiring elevated access, though it depends on user interaction. Fluxbox is not shipped or supported in Red Hat Enterprise Linux, which uses GNOME as its default desktop environment. As a result, standard Red Hat enterprise deployments remain unaffected by this issue unless third-party packages are manually installed and configured.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to eliminate shell invocation in Fluxbox when applying styles by spawning fbsetbg directly via execvp instead of executing through a shell: upgrade to the fixed Fluxbox builds, which execute fbsetbg directly via execvp without invoking a shell and rebuild gradient arguments from parsed texture flags instead of raw style text, closing all 3 injection vectors (crafted background pixmap path, crafted random mode directory path, crafted gradient texture string). Until patched, this is only a concern on Linux systems running the Fluxbox window manager where users load custom style or theme files — Standard Red Hat enterprise deployments using default desktop environments without Fluxbox installed are unaffected — so Do not load untrusted or third-party Fluxbox style and theme files, and restrict write access to local style directories. As a compensating measure, audit and log execve syscalls when commands are spawned from Fluxbox via the shell using auditd, detect unexpected shell executions and commands spawned by the Fluxbox process using Falco eBPF probes, restrict the actions and file access of commands spawned by the Fluxbox process using SELinux in enforcing mode, confine the execution capabilities and privileges of logged-in users running Fluxbox using SELinux confined user mappings, and detect anomalous child shell and process execution spawned from the Fluxbox window manager using an EDR agent. These controls limit blast radius and contain exploitation, but they do not fix the underlying OS command injection defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1307 Command Injection Prevention (No Shell Invocation) (high)
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
