CVE-2026-39958

The CVE concerns oma, the package manager for AOSC OS. Before version 1.25.2, oma-topics fetched metadata for Topic Manifests from remote repositories and registered them as APT sources. The name field in that metadata was not validated for transliteration, allowing a malicious manifest to lead t...