Heap Buffer Overflow in OCI Delta Stream Parser of Flatpak by Red Hat
CVE-2026-96280
7.5HIGH
What is CVE-2026-96280?
The OCI delta stream parser in Flatpak has a vulnerability where it reads sizes as guint64 and passes them to GLib I/O and allocation functions that expect gsize, which is 32 bits on 32-bit systems. This discrepancy can lead to undersized memory allocations, resulting in heap buffer overflows. If an attacker has control over an OCI registry, they can craft a malicious delta stream that exploits this vulnerability during the installation or updating of Flatpak applications, which may ultimately allow for arbitrary code execution on vulnerable 32-bit systems.
References
CVSS V3.1
Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Upstream acknowledges Sebastian Wick as the original reporter.