Heap Buffer Overflow in OCI Delta Stream Parser of Flatpak by Red Hat
CVE-2026-96280

7.5HIGH

Key Information:

Vendor: Red Hat
Status: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.4 Update Services For SAP Solutions
Vendor: CVE Published:; 27 September 2026

What is CVE-2026-96280?

The OCI delta stream parser in Flatpak has a vulnerability where it reads sizes as guint64 and passes them to GLib I/O and allocation functions that expect gsize, which is 32 bits on 32-bit systems. This discrepancy can lead to undersized memory allocations, resulting in heap buffer overflows. If an attacker has control over an OCI registry, they can craft a malicious delta stream that exploits this vulnerability during the installation or updating of Flatpak applications, which may ultimately allow for arbitrary code execution on vulnerable 32-bit systems.