🔔 Dear deepin users and community members,

A vulnerability has been discovered in APT, the package manager, that allows package integrity verification to be bypassed. Under specific conditions, an attacker positioned on the network path can substitute a package of their own making for one that has already passed verification, and have it executed with root privileges.

Since APT is the component through which every system update passes, the impact of exploitation would be substantial. All users are advised to update as soon as possible.

Vulnerability details

CVE ID: CVE-2026-109518

Description: When following an HTTP redirect, APT can merge two different package downloads into the same target file. If the download is then retried (resumed), the reused hard link is handled improperly, opening a window between verification and use — a time-of-check to time-of-use (TOCTOU) condition. An attacker can replace the contents of a package after it has been verified, so that the package ultimately installed differs from the one that was checked. This bypasses the verification boundary without requiring a valid signature on the replacement package. Reported by Max Justicz.

Severity: ⚠️⚠️⚠️ High (CVSS v4.0: 7.7)

Prerequisites:

1. The attacker is on the network path (same LAN, a rogue proxy, or a compromised mirror);
2. The package repository is fetched over HTTP and redirects are followed;
3. Acquire::Retries is non-zero.

A successfully installed package runs with root privileges. No exploitation in the wild has been reported to date.

Affected systems

All deepin 25 users who have not yet applied this update.

Fix

deepin 25:

apt has been updated to 2.8.4deepin1, which includes the upstream security update: the download methods now open target files exclusively (O_EXCL), so two downloads can no longer share and merge into the same file. Five out-of-bounds access issues are fixed as well:

• deb: guard against unsigned underflow when trimming control newlines;
• gpgv: do not advance past the null terminator in PushEntryWithKeyID;
• debDebFileParser: reject .deb packages missing a Version field;
• srvrec: reject res_query answers larger than the buffer;
• tagfile: fix the unbounded backward scan in Fill()'s trailing-newline check.

Please update via Control Center, or from a terminal:

sudo apt update && sudo apt dist-upgrade

Afterwards, confirm the version with apt --version (expect 2.8.4deepin1). No reboot is required.

Note: the download of the patched apt itself is still performed by the old, vulnerable apt. We recommend completing this update from a trusted network. If you cannot update immediately, running sudo apt -o Acquire::Retries=0 update disables download retries and removes one required condition — this is a temporary mitigation only and does not replace the update.

That's all for this update. Thank you, as always, for supporting the deepin community!