CVE-2026-96280

The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems.

Red Hat estimates the CVSSv3.1 vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.

The malicious stream is served over the network (AV:N), and the attacker needs only control over the OCI registry content (PR:N). The OCI delta stream parser reads sizes as a 64-bit guint64 but passes them to GLib I/O and allocation functions expecting gsize; on 32-bit systems gsize is only 32 bits wide, so the value is silently truncated, producing an undersized allocation while later operations still use the original 64-bit size, leading to a heap buffer overflow. This overflow only manifests on 32-bit targets — on 64-bit systems gsize and guint64 are the same width and truncation does not occur, so exploitability depends on a target configuration outside the attacker's control (AC:H). Meaningful user interaction is required (UI:R).

The vulnerable and impacted components remain within the same flatpak client/helper security authority (S:U). Because this is a heap buffer overflow with a stated path to code execution in the Flatpak client process, a successful exploit is treated as a full compromise of that process's privileges (C:H/I:H/A:H).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Only install applications from trusted OCI registries. Flatpak remotes using the default OSTree transport are not affected.