Loading story…
A publicly disclosed vulnerability in KDE Plasma allows a sandboxed application to trigger arbitrary code execution on the host through the "Open New Window" action. Researcher Kimiblock said Plasma determines what to launch by inspecting /proc/PID/cmdline and argv[0], which can be spoofed so the desktop starts the wrong program. The issue is particularly serious for sandboxed apps such as those distributed via Flatpak, because a malicious app can manipulate launch metadata and cause Plasma to spawn host binaries outside the sandbox boundary.
The disclosure says the bug remained unpatched in Plasma 6.7 after a 90-day embargo expired, prompting publication of proof-of-concept details. Separate reporting on KDE's ongoing Plasma 6.8 development and 6.7.2/6.7.3 maintenance updates noted the same launcher weakness alongside unrelated fixes for Chromium-based application crashes, VRR and RDP/session issues, systemd integration, and a KWin CPU usage bug on Intel systems, but did not indicate that the sandbox-escape flaw had been fully resolved.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A later report described the security-relevant "Open New Window" behavior as relying on /proc/PID/cmdline and argv[0], which could let applications spoof launch targets and cause the wrong program to start. The report highlighted Flatpak relevance in one version of the article, while another said Flatpak applications were unaffected.
After the 90-day embargo elapsed, Kimiblock publicly disclosed proof-of-concept details for an unpatched KDE Plasma vulnerability that could let a malicious sandboxed app spawn arbitrary host binaries via "Open New Window." The disclosure states the issue remained unpatched in Plasma 6.7 and that there had been no follow-up responses from KDE's security team before publication.
Developer Kimiblock discovered an arbitrary code execution issue in KDE Plasma's "Open New Window" action and reported it to KDE through the project's security contact. The disclosure says a 90-day embargo followed the report.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
opennet.me
Open sourceopennet.ru
Open sourcephoronix.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SafeBreach Labs disclosed **CVE-2025-59199**, a Windows 11 sandbox escape that allows a low-integrity process to gain medium-integrity code execution and perform arbitrary file writes after a single user click. The attack, dubbed **"Click Or Trick,"** chains weaknesses across several Windows components rather than exploiting one isolated flaw, combining a misconfigured COM object, Windows app identity and toast notification behavior, Snipping Tool URI handling, URI decoding quirks, and Microsoft Teams' exposed Chromium remote debugging interface. Researchers showed an attacker could launch a medium-integrity COM server from a low-integrity context, spoof a trusted toast notification, append attacker-controlled command-line arguments to legitimate applications, and then abuse the Chrome DevTools Protocol to write files outside the sandbox. Microsoft assigned the issue a **CVSS 7.8** score after it was reported on July 13, 2025, and released a patch on October 14, 2025; the findings underscore how security gaps at the boundaries between unrelated Windows subsystems can be combined into a practical sandbox escape chain.
Jun 29, 2026
A public proof-of-concept exploit dubbed **MiniPlasma** has been released for a Windows local privilege escalation flaw that can grant attackers **SYSTEM** access on fully patched machines. The exploit targets `cldflt.sys`, the Windows Cloud Files Mini Filter Driver used by cloud sync features such as OneDrive, and specifically abuses the `HsmOsBlockPlaceholderAccess` routine. Researchers said the bug appears tied to **`CVE-2020-17103`**, a vulnerability originally reported by Google Project Zero's James Forshaw in 2020 and believed to have been fixed by Microsoft, but the original exploit path reportedly still works. The exploit abuses missing access checks and a race condition during token switching to create arbitrary registry keys in the `.DEFAULT` user hive and ultimately spawn a SYSTEM shell. Researcher Chaotic Eclipse, also referenced as Nightmare-Eclipse, published the code on GitHub, while Will Dormann reported that it works reliably on Windows 11 systems with the May 2026 updates, though not on the latest Insider Preview Canary builds. Because the affected driver is broadly deployed across Windows environments, the release of reliable public exploit code sharply raises near-term risk while organizations await clarification or a fix from Microsoft.
Jul 1, 2026
Microsoft patched a critical Windows kernel elevation-of-privilege flaw, `CVE-2026-40369`, affecting Windows 11 versions 24H2 through 25H2 after public disclosure of technical details and proof-of-concept exploit code. The bug resides in `ntoskrnl.exe`, specifically `nt!ExpGetProcessInformation`, and can be triggered via `NtQuerySystemInformation`, including a zero-length request tied to information class `253`, causing an untrusted pointer dereference and unsafe kernel memory writes from an unprivileged process. Researchers said the vulnerability enables deterministic kernel memory modification, allowing attackers to build kernel read primitives, bypass KASLR, locate structures such as `EPROCESS`, alter token privileges, and ultimately obtain `NT AUTHORITY\SYSTEM` execution. Because the flaw is reachable from Chrome, Edge, and Firefox renderer sandboxes, it is considered especially dangerous for browser escape chains; defenders were urged to prioritize patching and watch for unusual `NtQuerySystemInformation` activity and anomalous kernel interaction patterns.
Jun 29, 2026