> 1. WINE et al run in a sandboxed environment. You cannot execute other Linux software without then also finding an RCE in WINE. So that’s multiple RCEs needed

> 1. WINE et al run in a sandboxed environment. You cannot execute other Linux software without then also finding an RCE in WINE. So that’s multiple RCEs needed in multiple points of the stack and the attacker needs to be aware that you’re running the uncommon set up of that Windows software running in WINE. Are you sure about this? I was the impression that there's nothing preventing an .exe running under Wine from just issuing Linux syscalls, eg. execve. EDIT: I just tested this, and indeed there doesn't seem to be any sandboxing: cursed.c: https://gist.github.com/q3k/e5952111283ea59ee78a7699919a055b https://gist.github.com/q3k/e5952111283ea59ee78a7699919a055b cursed.exe (built in msys2): https://object.ceph-eu.hswaw.net/q3k-personal/b8159d43e0698d27379c537a3cddc85f6df622329af9399e7caee3fc1d3a922d.exe https://object.ceph-eu.hswaw.net/q3k-personal/b8159d43e0698d... $ wine cursed.exe hello from win32 hello from linux hello from execve