Y2Y2
Open Cyber
Public vulnerability disclosure

CVE-2026-96280

Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems

publishedCWE-197

The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems.

Investigate in Cyber JSONMarkdown
Technical severity7.5 highCVSS 3.1 · CNA: redhat
Published2026-09-27Source updated 2026-11-02
Collected2026-11-022 attributed sources

Fixes and workarounds

Workaround

Only install applications from trusted OCI registries. Flatpak remotes using the default OSTree transport are not affected.

Source: CNA: redhat

Affected products and versions

ProductVersionsAuthority
Red Hat Enterprise Linux 10
Red Hat
flatpak
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:1.16.0-9.el10_2.4; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 10.0 Extended Update Support
Red Hat
flatpak
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:1.16.0-5.el10_0.6; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 8
Red Hat
flatpak
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:1.12.9-7.el8_10; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 9
Red Hat
flatpak
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:1.12.9-4.el9_8.4; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Red Hat
flatpak
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:1.12.7-5.el9_2.5; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
Red Hat
flatpak
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:1.12.9-3.el9_4.5; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 9.6 Extended Update Support
Red Hat
flatpak
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:1.12.9-4.el9_6.5; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 7
Red Hat
flatpak
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: affected 		CNA: redhat

Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.

CVSS assessments

Version / scoreVectorAuthority
3.1 / 7.5
high		 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HCNA: redhat

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References