{"affected":[{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"flatpak","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.16.0-9.el10_2.4","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"flatpak","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.16.0-5.el10_0.6","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"flatpak","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.12.9-7.el8_10","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"flatpak","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.12.9-4.el9_8.4","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"flatpak","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.12.7-5.el9_2.5","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"flatpak","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.12.9-3.el9_4.5","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"flatpak","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.12.9-4.el9_6.5","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"flatpak","product":"Red Hat Enterprise Linux 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-96280","cwes":["CWE-197"],"description":"The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems.","epss":{"date":"2026-11-01","percentile":0.47231,"score":0.00571},"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793622828200,"publishedAt":1790540352890,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:80497"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:80498"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:80687"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:89733"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:90364"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:92221"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:92369"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-96280"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539419"},{"source":"CNA: redhat","tags":[],"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-jr92-2v97-wgvc"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Only install applications from trusted OCI registries. Flatpak remotes using the default OSTree transport are not affected."}],"revision":"70da7af18da246eca33a0dab7e5d0840559431b690ebc9444f6e587fe62084b5","sources":[{"modifiedAt":1793622828200,"name":"CNA: redhat","retrievedAt":1793624986235,"url":"https://www.cve.org/CVERecord?id=CVE-2026-96280"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793624989716,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96280"}],"ssvc":{"assessedAt":1790697048098,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems","updatedAt":1793624989716}