CVE-2026-96280

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

• flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)

• flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)

• flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)

• flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

• flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)

• flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)

• flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)

• flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

• flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)

• flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)

• flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)

• flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

• flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)
• flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)
• flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)
• flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

• flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)
• flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)
• flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)
• flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

• flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)
• flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)
• flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)
• flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2026-96280: the OCI delta parser read sizes as guint64 and passed them to gsize APIs, and delta_read_data() allocated size + 1 bytes, which wraps to zero for size G_MAXSIZE; sizes are now gsize and clamped to G_MAXSIZE, delta_read_data() rejects size G_MAXSIZE and delta paths longer than PATH_MAX are rejected

• CVE-2026-96280: fix heap buffer overflow in OCI delta parsing by using gsize for delta sizes, rejecting oversized allocations and limiting delta paths to PATH_MAX

This update for flatpak fixes the following issues:

• CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host (bsc#1280236).
• CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream (bsc#1282514).
• CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).
• CVE-2026-96276: arbitrary write in host context via flatpak build-init (bsc#1282516).
• CVE-2026-96280: buffer overflow in OCI delta stream path names (bsc#1282518).
• CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).
• CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).
• CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on .ld.so (bsc#1282523).
• CVE-2026-96808: revokefs symlink path traversal allows local privilege escalation via commit tampering (bsc#1282524).

Changes for flatpak:

• Update to version 1.16.6 (jsc#PED-17048):

• Fix file descriptor leaks affecting Chromium-based browsers.
• Fix installing extra-data without a runtime, including openh264.
• Fix unusable sandbox-expose paths affecting Epiphany.
• Fix installed tests and handling of file descriptor arguments.

• Changes from version 1.16.5:

• Fix regressions from the sandbox escape security fix affecting browsers, browser-based apps and Steam.
• Expand test coverage of flatpak-run features used by the portal.

• Changes from version 1.16.4:

• Prevent arbitrary file reads in the system-helper context (GHSA-2fxp-43j9-pwvc).
• Prevent orphaning cross-user pull operations (GHSA-89xm-3m96-w3jg).

• Changes from version 1.16.3:

• Be selective about mapping font-dirs.xml in flatpak build.

• Changes from version 1.16.2:

• Support reinstalling bundle installations and Intel Xe VA-API.
• Add cancellation support for curl downloads.
• Fix font configuration, mask and pin configuration reloads, unintended home directory access, flatpak kill, OCI support, memory leaks and crashes.

• Changes from version 1.16.1:

• Allow updating existing apps under parental controls by default.
• Use instance IDs for systemd scopes and include /dev/udmabuf with --device=dri.
• Speed up prune --dry-run and permission-reset.
• Support TLS certificates in /etc/containers/certs.d for OCI.
• Fix portal crashes, sandbox environment handling, accessibility bus discovery, error reporting and shell completion.
• Update documentation and translations.

This update for flatpak fixes the following issues:

• CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769).
• CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770).
• CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host (bsc#1280236).
• CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream (bsc#1282514).
• CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).
• CVE-2026-96276: arbitrary write in host context via flatpak build-init (bsc#1282516).
• CVE-2026-96280: buffer overflow in OCI delta stream path names (bsc#1282518).
• CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).
• CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).
• CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on .ld.so (bsc#1282523).
• CVE-2026-96808: revokefs symlink path traversal allows local privilege escalation via commit tampering (bsc#1282524).

Changes for flatpak:

• Update to version 1.16.6 (jsc#PED-17048):

• Fix file descriptor leaks affecting Chromium-based browsers.
• Fix installing extra-data without a runtime, including OpenH264.
• Ignore unusable sandbox-expose paths for portal sub-sandboxes, fixing Epiphany regressions.
• Fix installed tests and handling of standard file descriptors passed as invalid flatpak run arguments.

• Switch from Autotools to Meson, preserving system bubblewrap, xdg-dbus-proxy, curl and distribution-specific installation paths.
• Require bubblewrap >= 0.10.0 and GPGME >= 1.8.0; add Meson, gettext, gtk-doc and polkit-agent build dependencies and drop obsolete intltool and libelf build dependencies.
• Generate the system-user pre-script from the Meson build directory and package the tmpfiles configuration and renamed manual pages.