CVE-2026-96280 Red Hat CVE debrief

Who should care

Defenders responsible for 32-bit systems using Flatpak, as well as those managing OCI registry sources, should assess exposure and prioritize verification and potential remediation.

Why it matters

CVE-2026-96280 is a heap buffer overflow vulnerability in the OCI delta stream parser used by Flatpak, potentially allowing code execution on 32-bit systems. Defenders should prioritize verifying exposure of 32-bit systems using Flatpak and assessing the integrity of OCI registry sources.

• Potential code execution on 32-bit systems during Flatpak installation or updates.
• Possible compromise of systems using vulnerable Flatpak versions.
• Need for verification of OCI registry source integrity.
• Priority for updating Flatpak to a version that addresses the vulnerability.

Technical summary

The OCI delta stream parser used by Flatpak reads sizes as guint64 but passes them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations. Subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems.

Defensive priority

Defenders should prioritize verifying exposure of 32-bit systems using Flatpak and assessing the integrity of OCI registry sources.

Recommended defensive actions

• Verify if 32-bit systems in your environment are using Flatpak and assess their exposure to the vulnerability.
• Review OCI registry sources for integrity and monitor for suspicious activity.
• Consider implementing compensating controls, such as restricting access to OCI registries or enhancing monitoring for potential exploitation attempts.
• Update Flatpak to a version that addresses the vulnerability, if available.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record describes a heap buffer overflow vulnerability in the OCI delta stream parser used by Flatpak, potentially allowing code execution on 32-bit systems during installation or updates from a crafted OCI registry.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.