{"id":"CVE-2026-96280","aliases":["ALSA-2026:80497","ALSA-2026:80498","ALSA-2026:80687","CLSA-2026-1792153368","CLSA-2026-1792626355","DEBIAN-CVE-2026-96280","EUVD-2026-88015","RHSA-2026:80497","RHSA-2026:80498","RHSA-2026:80687","RLSA-2026:80497","RLSA-2026:80498","RLSA-2026:80687","SUSE-SU-2026:4944-1","SUSE-SU-2026:5127-1","UBUNTU-CVE-2026-96280"],"status":"published","title":"Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems","description":"The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00586,"percentile":0.48291,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-197"],"published":"2026-09-27T20:19:12Z","modified":"2026-11-07T11:30:04Z","fixes":[{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak","fixed_in":["1.12.9-4.el9_6.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-devel","fixed_in":["1.12.9-4.el9_6.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-libs","fixed_in":["1.12.9-4.el9_6.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-selinux","fixed_in":["1.12.9-4.el9_6.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-session-helper","fixed_in":["1.12.9-4.el9_6.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-tests","fixed_in":["1.12.9-4.el9_6.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak","fixed_in":["1.12.7-2.el9_2.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-devel","fixed_in":["1.12.7-2.el9_2.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-libs","fixed_in":["1.12.7-2.el9_2.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-selinux","fixed_in":["1.12.7-2.el9_2.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-session-helper","fixed_in":["1.12.7-2.el9_2.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-tests","fixed_in":["1.12.7-2.el9_2.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"flatpak","fixed_in":["1.16.6-1~deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"flatpak","fixed_in":["1.18.1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-9.el10_2.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-9.el10_2.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-9.el10_2.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-9.el10_2.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-9.el10_2.4"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-7.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-7.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-7.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-7.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-7.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_6.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_6.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_6.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_6.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_6.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_6.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-2.el9_2.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-2.el9_2.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-2.el9_2.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-2.el9_2.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-2.el9_2.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-2.el9_2.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.10-1","1.14.10-1~deb12u1","1.14.10-1~deb12u2","1.14.4-1","1.14.4-1+deb12u1","1.14.4-1+deb12u1~bpo11+1","1.14.4-2","1.14.5-1","1.14.6-1","1.14.6-1~deb13u1","1.14.8-1","1.14.8-1~deb12u1","1.15.0-1","1.15.0-2","1.15.1-1","1.15.10-1","1.15.12-1","1.15.2-1","1.15.3-1","1.15.4-1","1.15.6-1","1.15.7-1","1.15.8-1","1.15.9-1","1.15.91-1","1.16.0-1","1.16.0-2","1.16.0-2~bpo12+1","1.16.1-1","1.16.1-1~bpo12+1","1.16.1-2","1.16.1-3","1.16.2-1","1.16.2-1~deb13u1","1.16.3-1","1.16.3-1~deb13u1","1.16.4-1","1.16.4-2","1.16.5-1","1.16.6-1","1.16.6-1~deb13u1","1.16.6-1~deb13u1~bpo12+1","1.16.6-1~deb13u2","1.16.6-1~deb13u3","1.17.2-1","1.17.3-1","1.17.3-2","1.17.6-1","1.18.0-1","1.18.1-1","1.18.2-1","1.18.3-1","1.18.4-1"]},{"source":"osv","ecosystem":"Debian:13","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-1~deb13u2"}]}],"versions":["1.16.1-1","1.16.1-2","1.16.1-3","1.16.2-1","1.16.2-1~deb13u1","1.16.3-1","1.16.3-1~deb13u1","1.16.4-1","1.16.4-2","1.16.5-1","1.16.6-1~deb13u1","1.16.6-1~deb13u1~bpo12+1"]},{"source":"osv","ecosystem":"Debian:14","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1"}]}],"versions":["1.16.1-1","1.16.1-2","1.16.1-3","1.16.2-1","1.16.2-1~deb13u1","1.16.3-1","1.16.3-1~deb13u1","1.16.4-1","1.16.4-2","1.16.5-1","1.16.6-1","1.16.6-1~deb13u1","1.16.6-1~deb13u1~bpo12+1","1.16.6-1~deb13u2","1.16.6-1~deb13u3","1.17.2-1","1.17.3-1","1.17.3-2","1.17.6-1","1.18.0-1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-9.el10_2.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-9.el10_2.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-9.el10_2.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-9.el10_2.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-9.el10_2.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-9.el10_2.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-9.el10_2.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-9.el10_2.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-9.el10_2.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-9.el10_2.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-7.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-7.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-7.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-7.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-7.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-7.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-7.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-7.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-7.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-7.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-7.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-7.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-7.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-7.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-7.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-7.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-7.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:10","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-9.el10_2.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-7.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150600.3.12.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150600.3.12.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150600.3.12.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150500.3.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150500.3.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150500.3.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150500.3.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.2-3","1.12.2-1","1.12.2-2","1.12.3-1","1.12.4-1","1.12.5-1","1.12.6-1","1.12.7-1","1.12.7-1ubuntu0.1","1.12.7-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.4-2","1.14.5-1","1.14.5-1build1","1.14.5-1build4","1.14.5-1build5","1.14.5-1build6","1.14.6-1","1.14.6-1ubuntu0.1","1.14.6-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.1-2ubuntu1","1.16.1-3ubuntu1","1.16.2-1","1.16.3-1","1.16.3-1build1","1.16.4-1","1.16.4-2","1.16.6-1"]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:80497","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:80498","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:80687","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:89733","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:90364","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:92221","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:92369","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:95493","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-96280","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539419","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-jr92-2v97-wgvc","tags":["article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-90616","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-96275","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-96808","tags":["report"]},{"url":"https://bugzilla.redhat.com/2532613","tags":["report"]},{"url":"https://bugzilla.redhat.com/2539416","tags":["report"]},{"url":"https://bugzilla.redhat.com/2539419","tags":["report"]},{"url":"https://bugzilla.redhat.com/2539569","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-80497.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-80498.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-80687.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1792153368.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96280","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792626355.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-96280","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532613","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539416","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539569","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80497.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90616","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90616","tags":["advisory"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-8688-9x26-hhxj","tags":["article"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/11/9","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96275","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96275","tags":["advisory"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-fqx6-vh4p-42cg","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96280","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96808","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96808","tags":["advisory"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-qrwq-7qwx-q9rp","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80498.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80687.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:80497","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:80498","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:80687","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264944-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1280236","tags":["report"]},{"url":"https://bugzilla.suse.com/1282514","tags":["report"]},{"url":"https://bugzilla.suse.com/1282515","tags":["report"]},{"url":"https://bugzilla.suse.com/1282516","tags":["report"]},{"url":"https://bugzilla.suse.com/1282518","tags":["report"]},{"url":"https://bugzilla.suse.com/1282519","tags":["report"]},{"url":"https://bugzilla.suse.com/1282520","tags":["report"]},{"url":"https://bugzilla.suse.com/1282523","tags":["report"]},{"url":"https://bugzilla.suse.com/1282524","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96280","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96808","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265127-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261769","tags":["report"]},{"url":"https://bugzilla.suse.com/1261770","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34079","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-96280","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-96280","title":"Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems","description":"The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems.","status":"published","published":"2026-09-27T20:19:12.89Z","modified":"2026-11-06T02:14:18.213Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-197"],"updated_at":"2026-11-06T03:26:01.286096Z"}],"euvd":[{"id":"EUVD-2026-88015","description":"The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems.","status":"published","published":"2026-09-27T20:19:12Z","modified":"2026-11-06T02:14:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-06T03:02:58.554056Z"}],"nvd":[{"id":"CVE-2026-96280","description":"The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems.","status":"published","published":"2026-09-27T21:17:04.2Z","modified":"2026-11-06T03:16:48.28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-197"],"updated_at":"2026-11-06T06:59:05.647867Z"}],"osv":[{"id":"DEBIAN-CVE-2026-96280","description":"The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems.","status":"published","published":"2026-09-27T21:17:04.2Z","modified":"2026-11-03T09:47:35.729723399Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T10:27:58.933618Z"},{"id":"RHSA-2026:80497","title":"Red Hat Security Advisory: flatpak security update","status":"published","published":"2026-10-14T10:31:41Z","modified":"2026-10-14T10:48:13.219641714Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:80498","title":"Red Hat Security Advisory: flatpak security update","status":"published","published":"2026-10-14T10:31:42Z","modified":"2026-10-14T10:48:08.669143177Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:80687","title":"Red Hat Security Advisory: flatpak security update","status":"published","published":"2026-10-14T10:32:12Z","modified":"2026-10-14T10:48:08.811153436Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:80497","title":"Important: flatpak security update","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.\n\nSecurity Fix(es):\n\n* flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)\n\n* flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)\n\n* flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)\n\n* flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-13T12:04:29.039883Z","modified":"2026-10-13T12:30:03.726111885Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:80498","title":"Important: flatpak security update","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.\n\nSecurity Fix(es):\n\n* flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)\n\n* flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)\n\n* flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)\n\n* flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-13T12:08:58.021554Z","modified":"2026-10-13T12:30:02.88417664Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:80687","title":"Important: flatpak security update","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.\n\nSecurity Fix(es):\n\n* flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)\n\n* flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)\n\n* flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)\n\n* flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-13T12:01:18.594323Z","modified":"2026-10-13T12:30:02.892467525Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-96280","description":"The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems.","status":"published","published":"2026-09-27T21:17:00Z","modified":"2026-11-04T20:04:29.677217963Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-04T21:43:26.87909Z"},{"id":"ALSA-2026:80497","title":"Important: flatpak security update","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.  \n\nSecurity Fix(es):  \n\n  * flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)\n  * flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)\n  * flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)\n  * flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-12T00:00:00Z","modified":"2026-10-29T11:32:38.070178714Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:80498","title":"Important: flatpak security update","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.  \n\nSecurity Fix(es):  \n\n  * flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)\n  * flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)\n  * flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)\n  * flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-12T00:00:00Z","modified":"2026-10-29T11:30:22.713968158Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:80687","title":"Important: flatpak security update","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.  \n\nSecurity Fix(es):  \n\n  * flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)\n  * flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)\n  * flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)\n  * flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-12T00:00:00Z","modified":"2026-10-29T11:00:51.469330547Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"CLSA-2026-1792153368","title":"flatpak: Fix of CVE-2026-96280","description":"- CVE-2026-96280: the OCI delta parser read sizes as guint64 and passed them\n  to gsize APIs, and delta_read_data() allocated size + 1 bytes, which wraps\n  to zero for size G_MAXSIZE; sizes are now gsize and clamped to G_MAXSIZE,\n  delta_read_data() rejects size G_MAXSIZE and delta paths longer than\n  PATH_MAX are rejected","status":"published","published":"2026-10-16T12:22:57Z","modified":"2026-10-26T09:31:36.592523677Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792626355","title":"flatpak: Fix of CVE-2026-96280","description":"- CVE-2026-96280: fix heap buffer overflow in OCI delta parsing by using gsize\n  for delta sizes, rejecting oversized allocations and limiting delta paths to\n  PATH_MAX","status":"published","published":"2026-10-21T23:46:11Z","modified":"2026-10-26T09:31:01.974992931Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"SUSE-SU-2026:4944-1","title":"Security update for flatpak","description":"This update for flatpak fixes the following issues:\n\n- CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access\n  to files on the host (bsc#1280236).\n- CVE-2026-92162: path traversal via unvalidated `arch` parameter in `DeployAppstream` (bsc#1282514).\n- CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).\n- CVE-2026-96276: arbitrary write in host context via `flatpak build-init` (bsc#1282516).\n- CVE-2026-96280: buffer overflow in OCI delta stream path names (bsc#1282518).\n- CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).\n- CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).\n- CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on `.ld.so` (bsc#1282523).\n- CVE-2026-96808: `revokefs` symlink path traversal allows local privilege escalation via commit tampering\n  (bsc#1282524).\n\nChanges for flatpak:\n\n- Update to version 1.16.6 (jsc#PED-17048):\n + Fix file descriptor leaks affecting Chromium-based browsers.\n + Fix installing extra-data without a runtime, including openh264.\n + Fix unusable sandbox-expose paths affecting Epiphany.\n + Fix installed tests and handling of file descriptor arguments.\n- Changes from version 1.16.5:\n + Fix regressions from the sandbox escape security fix affecting\n browsers, browser-based apps and Steam.\n + Expand test coverage of flatpak-run features used by the portal.\n- Changes from version 1.16.4:\n + Prevent arbitrary file reads in the system-helper context\n (GHSA-2fxp-43j9-pwvc).\n + Prevent orphaning cross-user pull operations (GHSA-89xm-3m96-w3jg).\n- Changes from version 1.16.3:\n + Be selective about mapping font-dirs.xml in flatpak build.\n- Changes from version 1.16.2:\n + Support reinstalling bundle installations and Intel Xe VA-API.\n + Add cancellation support for curl downloads.\n + Fix font configuration, mask and pin configuration reloads,\n unintended home directory access, flatpak kill, OCI support,\n memory leaks and crashes.\n- Changes from version 1.16.1:\n + Allow updating existing apps under parental controls by default.\n + Use instance IDs for systemd scopes and include /dev/udmabuf\n with --device=dri.\n + Speed up prune --dry-run and permission-reset.\n + Support TLS certificates in /etc/containers/certs.d for OCI.\n + Fix portal crashes, sandbox environment handling, accessibility\n bus discovery, error reporting and shell completion.\n + Update documentation and translations.\n","status":"published","published":"2026-10-29T16:29:47Z","modified":"2026-10-31T18:00:03.939717669Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:5127-1","title":"Security update for flatpak","description":"This update for flatpak fixes the following issues:\n\n- CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769).\n- CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770).\n- CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access\n  to files on the host (bsc#1280236).\n- CVE-2026-92162: path traversal via unvalidated `arch` parameter in `DeployAppstream` (bsc#1282514).\n- CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).\n- CVE-2026-96276: arbitrary write in host context via `flatpak build-init` (bsc#1282516).\n- CVE-2026-96280: buffer overflow in OCI delta stream path names (bsc#1282518).\n- CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).\n- CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).\n- CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on `.ld.so` (bsc#1282523).\n- CVE-2026-96808: `revokefs` symlink path traversal allows local privilege escalation via commit tampering\n  (bsc#1282524).\n\nChanges for flatpak:\n\n- Update to version 1.16.6 (jsc#PED-17048):\n + Fix file descriptor leaks affecting Chromium-based browsers.\n + Fix installing extra-data without a runtime, including OpenH264.\n + Ignore unusable sandbox-expose paths for portal sub-sandboxes,\n fixing Epiphany regressions.\n + Fix installed tests and handling of standard file descriptors\n passed as invalid flatpak run arguments.\n- Switch from Autotools to Meson, preserving system bubblewrap,\n xdg-dbus-proxy, curl and distribution-specific installation paths.\n- Require bubblewrap \u003e= 0.10.0 and GPGME \u003e= 1.8.0; add Meson,\n gettext, gtk-doc and polkit-agent build dependencies and drop\n obsolete intltool and libelf build dependencies.\n- Generate the system-user pre-script from the Meson build directory\n and package the tmpfiles configuration and renamed manual pages.\n","status":"published","published":"2026-11-06T08:27:38Z","modified":"2026-11-07T11:30:04.13853174Z","updated_at":"2026-11-07T11:45:54.882758Z"}]}}