Bug 2539419 (CVE-2026-96280) - CVE-2026-96280 flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems
Summary: CVE-2026-96280 flatpak: flatpak: Buffer overflow in OCI delta stream path nam...
Keywords:
Status: NEW
Alias: CVE-2026-96280
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-23 14:02 UTC by OSIDB Bzimport
Modified: 2026-09-27 20:16 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-23 14:02:14 UTC 
GHSA-jr92-2v97-wgvc (https://github.com/flatpak/flatpak/security/advisories/GHSA-jr92-2v97-wgvc)

Description: The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems). The silent truncation causes undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. On 64-bit systems, gsize and guint64 are the same width, so the truncation does not occur and the issue is not practically exploitable.

Mitigation: Only install applications from trusted OCI registries. Flatpak remotes using the default OSTree transport are not affected. Fixed in 1.18.1 (backports available for 1.16.x). Reported by @swick.
Note You need to log in before you can comment on or make changes to this bug.