Riskcovery

CVE-2026-96280

Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems

State
Published
Severity
7.5 High
Published
Sep 27, 2026
Updated
Oct 29, 2026
Reserved
Sep 22, 2026

Read the record on cve.org

Description

The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:Hredhat

Weaknesses

Affected Products

ProductVersions
Red Hat Enterprise Linux 10Red Hat
  • 0:1.16.0-9.el10_2.4 and laterNot affected
Red Hat Enterprise Linux 8Red Hat
  • 0:1.12.9-7.el8_10 and laterNot affected
Red Hat Enterprise Linux 9Red Hat
  • 0:1.12.9-4.el9_8.4 and laterNot affected
Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsRed Hat
  • 0:1.12.7-5.el9_2.5 and laterNot affected
Red Hat Enterprise Linux 9.4 Update Services for SAP SolutionsRed Hat
  • 0:1.12.9-3.el9_4.5 and laterNot affected
Red Hat Enterprise Linux 9.6 Extended Update SupportRed Hat
  • 0:1.12.9-4.el9_6.5 and laterNot affected
Red Hat Enterprise Linux 7Red Hat

    References

    Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.