CVE-2026-96280: Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-27 · updated 2026-10-29
Weakness: CWE-197

Description

The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems.

Affected products

Red Hat Enterprise Linux 10: all versions — fixed in 0:1.16.0-9.el10_2.4
Red Hat Enterprise Linux 7: all versions
Red Hat Enterprise Linux 8: all versions — fixed in 0:1.12.9-7.el8_10
Red Hat Enterprise Linux 9: all versions — fixed in 0:1.12.9-4.el9_8.4
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: all versions — fixed in 0:1.12.7-5.el9_2.5
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions: all versions — fixed in 0:1.12.9-3.el9_4.5
Red Hat Enterprise Linux 9.6 Extended Update Support: all versions — fixed in 0:1.12.9-4.el9_6.5

How to fix

Upgrade to a fixed version: Red Hat Enterprise Linux 10 0:1.16.0-9.el10_2.4; Red Hat Enterprise Linux 8 0:1.12.9-7.el8_10; Red Hat Enterprise Linux 9 0:1.12.9-4.el9_8.4; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:1.12.7-5.el9_2.5; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:1.12.9-3.el9_4.5; Red Hat Enterprise Linux 9.6 Extended Update Support 0:1.12.9-4.el9_6.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-96280 or the next vulnerability affects your stack