Vulnerability · Published Sep 27, 2026 · Assigned by redhat
CVE-2026-96280Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems
High 7.5
In plain English
A high-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | flatpak | 1.16.0-9.el10_2.4 | ALSA-2026:80498 |
| AlmaLinux:8 | flatpak | 1.12.9-7.el8_10 | ALSA-2026:80687 |
| AlmaLinux:9 | flatpak | 1.12.9-4.el9_8.4 | ALSA-2026:80497 |
| AlmaLinux:10 | flatpak-devel | 1.16.0-9.el10_2.4 | ALSA-2026:80498 |
| AlmaLinux:8 | flatpak-devel | 1.12.9-7.el8_10 | ALSA-2026:80687 |
| AlmaLinux:9 | flatpak-devel | 1.12.9-4.el9_8.4 | ALSA-2026:80497 |
| AlmaLinux:10 | flatpak-libs | 1.16.0-9.el10_2.4 | ALSA-2026:80498 |
| AlmaLinux:8 | flatpak-libs | 1.12.9-7.el8_10 | ALSA-2026:80687 |
| AlmaLinux:9 | flatpak-libs | 1.12.9-4.el9_8.4 | ALSA-2026:80497 |
| AlmaLinux:10 | flatpak-selinux | 1.16.0-9.el10_2.4 | ALSA-2026:80498 |
| AlmaLinux:8 | flatpak-selinux | 1.12.9-7.el8_10 | ALSA-2026:80687 |
| AlmaLinux:9 | flatpak-selinux | 1.12.9-4.el9_8.4 | ALSA-2026:80497 |
| AlmaLinux:10 | flatpak-session-helper | 1.16.0-9.el10_2.4 | ALSA-2026:80498 |
| AlmaLinux:8 | flatpak-session-helper | 1.12.9-7.el8_10 | ALSA-2026:80687 |
| AlmaLinux:9 | flatpak-session-helper | 1.12.9-4.el9_8.4 | ALSA-2026:80497 |
| Debian:12 | flatpak | no fix listed | DEBIAN-CVE-2026-96280 |
| Debian:13 | flatpak | 1.16.6-1~deb13u2 | DEBIAN-CVE-2026-96280 |
| Debian:14 | flatpak | 1.18.1-1 | DEBIAN-CVE-2026-96280 |
| Rocky Linux:10 | flatpak | 0:1.16.0-9.el10_2.4 | RLSA-2026:80498 |
| Rocky Linux:8 | flatpak | 0:1.12.9-7.el8_10 | RLSA-2026:80687 |
| Rocky Linux:9 | flatpak | 0:1.12.9-4.el9_8.4 | RLSA-2026:80497 |
| Ubuntu:26.04:LTS | flatpak | no fix listed | UBUNTU-CVE-2026-96280 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | see references |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | see references |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
Weakness: CWE-197 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- RHSA-2026:80497 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:80498 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:80687 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:89733 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:90364 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:92221 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:92369 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-96280 vdb-entry, x_refsource_REDHAT
- RHBZ#2539419 issue-tracking, x_refsource_REDHAT
- https://github.com/flatpak/flatpak/security/advisories/GHSA-jr92-2v97-wgvc