CVE-2026-96280
Fixed in a distro release EPSS <1%CVSS 7.5
The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems.
Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 7
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 10 | flatpak | 1.16.0-9.el10_2.4 |
| AlmaLinux 10 | flatpak-devel | 1.16.0-9.el10_2.4 |
| AlmaLinux 10 | flatpak-libs | 1.16.0-9.el10_2.4 |
| AlmaLinux 10 | flatpak-selinux | 1.16.0-9.el10_2.4 |
| AlmaLinux 10 | flatpak-session-helper | 1.16.0-9.el10_2.4 |
| AlmaLinux 8 | flatpak | 1.12.9-7.el8_10 |
| AlmaLinux 8 | flatpak-devel | 1.12.9-7.el8_10 |
| AlmaLinux 8 | flatpak-libs | 1.12.9-7.el8_10 |
| AlmaLinux 8 | flatpak-selinux | 1.12.9-7.el8_10 |
| AlmaLinux 8 | flatpak-session-helper | 1.12.9-7.el8_10 |
| AlmaLinux 9 | flatpak | 1.12.9-4.el9_8.4 |
| AlmaLinux 9 | flatpak-devel | 1.12.9-4.el9_8.4 |
| AlmaLinux 9 | flatpak-libs | 1.12.9-4.el9_8.4 |
| AlmaLinux 9 | flatpak-selinux | 1.12.9-4.el9_8.4 |
| AlmaLinux 9 | flatpak-session-helper | 1.12.9-4.el9_8.4 |
| Debian 12 | flatpak | no fix |
| Debian 13 | flatpak | 1.16.6-1~deb13u2 |
| Debian 14 | flatpak | 1.18.1-1 |
| Red Hat Enterprise Linux 10.2 | flatpak | 0:1.16.0-9.el10_2.4 |
| Red Hat Enterprise Linux 10.2 | flatpak-debuginfo | 0:1.16.0-9.el10_2.4 |
| Red Hat Enterprise Linux 10.2 | flatpak-debugsource | 0:1.16.0-9.el10_2.4 |
| Red Hat Enterprise Linux 10.2 | flatpak-devel | 0:1.16.0-9.el10_2.4 |
| Red Hat Enterprise Linux 10.2 | flatpak-libs | 0:1.16.0-9.el10_2.4 |
| Red Hat Enterprise Linux 10.2 | flatpak-libs-debuginfo | 0:1.16.0-9.el10_2.4 |
| Red Hat Enterprise Linux 10.2 | flatpak-selinux | 0:1.16.0-9.el10_2.4 |
| Red Hat Enterprise Linux 10.2 | flatpak-session-helper | 0:1.16.0-9.el10_2.4 |
| Red Hat Enterprise Linux 10.2 | flatpak-session-helper-debuginfo | 0:1.16.0-9.el10_2.4 |
| Red Hat Enterprise Linux 10.2 | flatpak-tests-debuginfo | 0:1.16.0-9.el10_2.4 |
| Red Hat Enterprise Linux 8 | flatpak | 0:1.12.9-7.el8_10 |
| Red Hat Enterprise Linux 8 | flatpak-debuginfo | 0:1.12.9-7.el8_10 |
| Red Hat Enterprise Linux 8 | flatpak-debugsource | 0:1.12.9-7.el8_10 |
| Red Hat Enterprise Linux 8 | flatpak-devel | 0:1.12.9-7.el8_10 |
| Red Hat Enterprise Linux 8 | flatpak-libs | 0:1.12.9-7.el8_10 |
| Red Hat Enterprise Linux 8 | flatpak-libs-debuginfo | 0:1.12.9-7.el8_10 |
| Red Hat Enterprise Linux 8 | flatpak-selinux | 0:1.12.9-7.el8_10 |
| Red Hat Enterprise Linux 8 | flatpak-session-helper | 0:1.12.9-7.el8_10 |
| Red Hat Enterprise Linux 8 | flatpak-session-helper-debuginfo | 0:1.12.9-7.el8_10 |
| Red Hat Enterprise Linux 8 | flatpak-tests-debuginfo | 0:1.12.9-7.el8_10 |
| Red Hat Enterprise Linux 9 | flatpak | 0:1.12.9-4.el9_8.4 |
| Red Hat Enterprise Linux 9 | flatpak-debuginfo | 0:1.12.9-4.el9_8.4 |
| Red Hat Enterprise Linux 9 | flatpak-debugsource | 0:1.12.9-4.el9_8.4 |
| Red Hat Enterprise Linux 9 | flatpak-devel | 0:1.12.9-4.el9_8.4 |
| Red Hat Enterprise Linux 9 | flatpak-libs | 0:1.12.9-4.el9_8.4 |
| Red Hat Enterprise Linux 9 | flatpak-libs-debuginfo | 0:1.12.9-4.el9_8.4 |
| Red Hat Enterprise Linux 9 | flatpak-selinux | 0:1.12.9-4.el9_8.4 |
| Red Hat Enterprise Linux 9 | flatpak-session-helper | 0:1.12.9-4.el9_8.4 |
| Red Hat Enterprise Linux 9 | flatpak-session-helper-debuginfo | 0:1.12.9-4.el9_8.4 |
| Red Hat Enterprise Linux 9 | flatpak-tests-debuginfo | 0:1.12.9-4.el9_8.4 |
| Rocky Linux 10 | flatpak | 0:1.16.0-9.el10_2.4 |
| Rocky Linux 8 | flatpak | 0:1.12.9-7.el8_10 |
| Rocky Linux 9 | flatpak | 0:1.12.9-4.el9_8.4 |
| Ubuntu 26.04 LTS | flatpak | no fix |
| Ubuntu Pro 18.04 LTS | flatpak | no fix |
| Ubuntu Pro 20.04 LTS | flatpak | no fix |
| Ubuntu Pro 22.04 LTS | flatpak | no fix |
| Ubuntu Pro 24.04 LTS | flatpak | no fix |