I am an (Ubuntu) Linux user. Sometimes, I have to use Wine for running Windows executables.

I would like to know if Windows malware (virus, trojan, worm,...), i.e. malware that was not intended to do harm when being executed with Wine on Linux, can do harm to my Linux system. I use a standard Wine installation. Wine is never executed as a superuser.

I guess it could read/write/delete files from my folder, and connect with the Internet.

I think, but I'm not quite sure, that it can't install software. Could it install harmful (Firefox) plugins?

  • If it has access to your memory, it can do quite a bit.
    – JVE999
    Commented Jul 24, 2014 at 19:45

3 Answers 3


You are right about accessing the file system and internet, especially because the home folder is mapped with write permission by default. This implies that it can mess with your documents as well, for example adding macros to Open Office documents, deleting your mp3 files or sending interesting files to someone on the internet.

And yes, it can write to your Firefox profile and install an Addon.

Connecting to the internet means, that it can fetch commands from a C&C server to turn your computer into a drone.

I guess some maleware will fail to find those locations outside the standard windows folders. But other will just scan all drives for interesting places.

  • The malware would need to be Wine-aware in order to traverse the directory tree above /home/user/.wine/drive_c Commented Jul 10, 2011 at 23:43
  • 9
    @Amazed, in the default configuration / is mapped as Z:. So a Windows program can modify files in Z:\home\hendrik\documents without knowing anything about Wine or Linux. All it has to do is to look for documents outside C:\Documents and Settings\hendrik. This is not as unlikely as it may seem on first glance because it is the standard way to spread across network shares. Commented Jul 11, 2011 at 4:41
  • good point! I forgot about Z:\ Commented Jul 11, 2011 at 5:18
  • 1
    It would still have to be wine aware to install a firefox addon or it won't find firefox's profile directory.
    – Joshua
    Commented Jul 24, 2014 at 18:08
  • @Joshua It could look for files that look like Firefox profile files then install the add-on in the directory. Firefox is pretty much the same cross-platform.
    – wizzwizz4
    Commented May 14, 2017 at 9:19

Theoretically, yes.

Firstly, a bit of background on Wine. Wine provides an executable loader for running Windows executables. Also installed or made use of optionally is a binfmt handler described here, which is how the linux kernel deduces what loader to execute - for example, somewhere built into the kernel is a binfmt handler for ELF files for Linux. Function calls from these executables are then translated by the Wine runtime into their equivalent Linux system calls. The Wine FAQ deals with the question of wine being an emulator.

So, back to your question - could Windows malware infect a Linux box? I said theoretically yes - here are the various threats you face:

  • Bugs in the format handlers. If a specially crafted executable causes Wine to incorrectly load the PE file, you might well be able to exploit it.
  • Bugs in Wine's function translation. This is the same as saying "bugs in the Windows API", if you like - if certain functions translated in Wine are susceptible to buffer overflows etc, then they can be exploited.
  • The fact that function calls are translated. This very fact in itself means malicious activity can happen.
  • The setup and limitations of the Wine install. What file systems have you mapped? Can the executable escape this "chroot"?

There is one key proviso here - being aware or planning for infecting Wine. If malware is written with the expectation that it may be run on Wine, then it can begin to use Wine specific exploits, possibly detecting that Z: is mapped to / and performing appropriate actions. The earlier points in my list above are the least likely, but also the most damaging if they occur.

However, most malware is not written for Wine. You can think of Wine as a separate build target, almost, since how it implements the Windows API is different to how Windows implements the API. Most malware is aimed squarely at Windows, so I'd expect the damage to occur only to the "Windows" install. Indeed some malware may not run, where the Wine developers have assumed strict usage of an API function and where Windows allows something different.

So, to cut a long story short, Wine increases your attack surface by a sizeable amount by allowing you to execute arbitrary Windows programs. The same general rules apply to Wine as apply to any piece of software:

  • Do you need it? If not, don't install it.
  • Is it up to date? If not, update it.
  • Be careful what you run with it. It is not a substitute for being careful with what you download, access and run.

Been a long time since I've done C structured exceptions (MS specific but emulated on Wine), but the syntax is close to this. Somebody using this could have a lot of fun even if Z is not mapped.

bool isLinux = 0;
__try {
    asm {
        mov AL, 172
        int 80h
    isLinux = 1;
} __except {}
if (isLinux)
   asm {
      /* Linux shellcode here */
  • 2
    Please explain your code. Commented Jul 24, 2014 at 18:20
  • The code attempts a Linux system call, which will throw invalid instruction on Windows, but __except{} will eat the SEH exception.
    – Joshua
    Commented Jul 24, 2014 at 18:28
  • So what happens when this gets executed on a windows computer? What could happen when it gets executed on Linux via wine? Commented Jul 24, 2014 at 19:12
  • (By the way: The -1 is not from me.) Commented Jul 24, 2014 at 19:14
  • Windows: int80 raises exception caught by __except() and isLinus = 0. Linux: control passes through the asm block setting isLinux = 1. Now it knows to apply the Linux specific payload say either by downloading and running a binary or unpacking it from resources and then calling it with exec() which it can by repeating the asm trick (no more try necessary).
    – Joshua
    Commented Jul 24, 2014 at 21:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .