CVE-2026-96280

Received Received - Intake

Heap Buffer Overflow in Flatpak OCI Delta Stream Parser

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: redhat-SADP

Description

The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-27

Last Modified

2026-09-27

Generated

2026-09-28

AI Q&A

2026-09-28

EPSS Evaluated

N/A

NVD

CVE-2026-96280

EUVD

EUVD-2026-88015

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	flatpak	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-197	Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.

Attack-Flow Graph

Executive Summary

This vulnerability involves a flaw in the OCI delta stream parser where sizes are read as 64-bit integers but passed to functions expecting 32-bit sizes on 32-bit systems. This causes undersized memory allocations while operations use the original 64-bit size, leading to heap buffer overflows.

Detection Guidance

This vulnerability affects 32-bit systems during Flatpak install or update operations when processing OCI delta streams. Detection requires checking Flatpak versions and monitoring for heap buffer overflows during these operations. No direct commands are provided in the context to detect this specific issue.

Impact Analysis

An attacker controlling an OCI registry could exploit this during flatpak install or update to execute arbitrary code on 32-bit systems. This could allow unauthorized access, data theft, or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized code execution on 32-bit systems, potentially compromising data confidentiality and integrity. For GDPR, it may result in unauthorized access to personal data. For HIPAA, it could expose protected health information. Compliance may be impacted if the affected systems handle regulated data.

Mitigation Strategies

Update Flatpak to the latest version to ensure the OCI delta stream parser fix is applied. Avoid using Flatpak on 32-bit systems if possible. Monitor for suspicious activity during Flatpak operations.

Hi! I’m here to help you understand CVE-2026-96280. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70