==========================================================================
Ubuntu Security Notice USN-8256-1
May 07, 2026

opam vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 25.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

opam could be made to install files in unintended locations if it installed
a specially crafted package.

Software Description:
- opam: package manager for OCaml

Details:

Andrew Nesbitt discovered that opam did not properly validate file
destination paths in package install files. An attacker could use this
issue to bypass sandbox protections and write files to arbitrary locations,
possibly leading to arbitrary code execution.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  opam                            2.5.0-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro
  opam-installer                  2.5.0-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 25.10
  opam                            2.3.0-1+deb13u1build0.25.10.1
  opam-installer                  2.3.0-1+deb13u1build0.25.10.1

Ubuntu 24.04 LTS
  opam                            2.1.5-1ubuntu0.1~esm2
                                  Available with Ubuntu Pro
  opam-installer                  2.1.5-1ubuntu0.1~esm2
                                  Available with Ubuntu Pro

Ubuntu 22.04 LTS
  opam                            2.1.2-1+deb12u1build0.22.04.1
  opam-installer                  2.1.2-1+deb12u1build0.22.04.1

Ubuntu 20.04 LTS
  opam                            2.0.5-1ubuntu1+esm1
                                  Available with Ubuntu Pro
  opam-installer                  2.0.5-1ubuntu1+esm1
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8256-1
  CVE-2026-41082

Package Information:
  https://launchpad.net/ubuntu/+source/opam/2.3.0-1+deb13u1build0.25.10.1
  https://launchpad.net/ubuntu/+source/opam/2.1.2-1+deb12u1build0.22.04.1