CVE-2026-96280: Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems
GHSA-jr92-2v97-wgvc (https://github.com/flatpak/flatpak/security/advisories/GHSA-jr92-2v97-wgvc)
Description: The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems). The silent truncation causes undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. On 64-bit systems, gsize and guint64 are the same width, so the truncation does not occur and the issue is not practically exploitable.
Mitigation: Only install applications from trusted OCI registries. Flatpak remotes using the default OSTree transport are not affected. Fixed in 1.18.1 (backports available for 1.16.x). Reported by @swick.
Other sources
The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flatpakto a version that resolves this vulnerability.Fixed in 1.18.1 - Compensating control
Only install applications from trusted OCI registries.
Event History
Frequently Asked Questions
Which deployments are realistically affected?
The issue is practically exploitable on 32-bit systems, where gsize is 32 bits. On 64-bit systems, gsize and guint64 have the same width, so the truncation does not occur.
What must an attacker control to exploit this?
An attacker needs control of an OCI registry and must provide a crafted OCI delta stream. The vulnerable parsing occurs during a Flatpak install or update.
Are default Flatpak remotes affected?
No. Flatpak remotes using the default OSTree transport are not affected; the exposure is specific to OCI transport and its delta stream parser.
What can be done before a fix is deployed?
On 32-bit systems, only install applications from trusted OCI registries. Avoid untrusted OCI registries until an update is available.
Which versions contain fixes?
The issue is fixed in Flatpak 1.18.1, with backports available for the 1.16.x series.