Flatpak 1.18.3 Released With Security and Regression Fixes

Flatpak 1.18.3 is out with updated Bubblewrap and xdg-dbus-proxy components, plus fixes for regressions introduced in version 1.18.2.

ByBobby Borisov
OnSeptember 22, 2026
1 Comment

Flatpak 1.18.3 Released With Security and Regression Fixes

Flatpak 1.18.3 has been released as the latest maintenance update to the 1.18 series, with a small batch of security-related dependency updates and bug fixes.

The release updates the bundled Meson subprojects for Bubblewrap to version 0.12 and xdg-dbus-proxy to version 0.1.8. According to the release notes, these updates address CVE-2026-87766 and CVE-2026-93676, respectively.

Flatpak 1.18.3 also fixes regressions introduced in version 1.18.2 when building applications and runtimes. The problems were especially noticeable on systems using SELinux and when the required runtime was not installed per user.

Another fix targets subsandbox startup through flatpak-spawn. Previously, this could fail when launched from an application using the --no-talk-name or --system-no-talk-name options. The issue is now resolved.

In addition, the update fixes a crash that could occur when installing a Flatpak bundle while supplying explicit key bytes.

For more details on all changes in Flatpak 1.18.3, see the changelog.

Tell others:

Bobby Borisov

Bobby, an editor-in-chief at Linuxiac, is a Linux professional with over 20 years of experience. With a strong focus on Linux and open-source software, he has worked as a Senior Linux System Administrator, Software Developer, and DevOps Engineer for small and large multinational companies.