diff --git a/NEWS b/NEWS
index 81c2595e..f6b920ac 100644
--- a/NEWS
+++ b/NEWS
@@ -2,7 +2,14 @@ Changes in 1.14.6
 ~~~~~~~~~~~~~~~~~
 Released: not yet
 
-Bug fixes:
+Security fixes:
+
+ * Don't allow an executable name to be misinterpreted as a command-line
+   option for bwrap(1). This prevents a sandbox escape where a malicious
+   or compromised app could ask xdg-desktop-portal to generate a .desktop
+   file with access to files outside the sandbox. (CVE-2024-32462)
+
+Other bug fixes:
 
  * Don't parse `<developer><name/></developer>` as the application name
    (#5700)