high7.5
CVE-2026-96280
Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems
Impact
The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | All versions |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | All versions |
| Red Hat | Red Hat Enterprise Linux 8 | All versions |
| Red Hat | Red Hat Enterprise Linux 9 | All versions |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services For SAP Solutions | All versions |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services For SAP Solutions | All versions |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | All versions |
| Red Hat | Red Hat Enterprise Linux 7 | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- https://access.redhat.com/errata/RHSA-2026:80497
- https://access.redhat.com/errata/RHSA-2026:80498
- https://access.redhat.com/errata/RHSA-2026:80687
- https://access.redhat.com/errata/RHSA-2026:89733
- https://access.redhat.com/errata/RHSA-2026:90364
- https://access.redhat.com/errata/RHSA-2026:92369
- https://access.redhat.com/security/cve/CVE-2026-96280
- https://bugzilla.redhat.com/show_bug.cgi?id=2539419
- https://github.com/flatpak/flatpak/security/advisories/GHSA-jr92-2v97-wgvc
- https://access.redhat.com/errata/RHSA-2026:92221