{"id":"CVE-2026-96280","revision":"f87cc6789cff4d22a297b7e35a81ecbd","records":[{"revision":"f87cc6789cff4d22a297b7e35a81ecbd","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-96280","aliases":[],"title":"Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems","description":"The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems.","state":0,"publishedAt":"2026-09-27T20:19:12.89+00:00","modifiedAt":"2026-10-12T16:25:45.209+00:00","affected":[{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"flatpak","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 10\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"flatpak\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0:1.16.0-9.el10_2.4\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/o:redhat:enterprise_linux:10.2\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"flatpak","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 8\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"flatpak\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0:1.12.9-7.el8_10\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:8::appstream\",\n                        \"cpe:/a:redhat:enterprise_linux:8::crb\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"flatpak","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 9\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"flatpak\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0:1.12.9-4.el9_8.4\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:9::appstream\",\n                        \"cpe:/a:redhat:enterprise_linux:9::crb\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"flatpak","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 7\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"flatpak\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/o:redhat:enterprise_linux:7\"\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.5,"severity":"HIGH"}],"references":["https://access.redhat.com/errata/RHSA-2026:80497","https://access.redhat.com/errata/RHSA-2026:80498","https://access.redhat.com/errata/RHSA-2026:80687","https://access.redhat.com/security/cve/CVE-2026-96280","https://bugzilla.redhat.com/show_bug.cgi?id=2539419","https://github.com/flatpak/flatpak/security/advisories/GHSA-jr92-2v97-wgvc"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-96280","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-96280","identifiers":["CVE-2026-96280"]},"retained":false,"historicalAffected":[]}],"coverage":[]}