Back github.com

GHSA Jr92 2v97 Wgvc

github.com • September 28, 2026

Arbitrary code execution when installing or updating Flatpak applications from a malicious OCI registry on 32-bit systems.

The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems). The silent truncation causes undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install or flatpak update, potentially achieving code execution in the Flatpak client process.

On 64-bit systems, gsize and guint64 are the same width, so the truncation does not occur and the issue is not practically exploitable.

The issue has been patched in version 1.18.1 by commits:

892d261 "oci: Use gsize for OCI delta sizes"

c52e851 "oci: Avoid overflow in delta_read_data"

f710ca1 "oci: Limit delta path length to PATH_MAX"

For LTS operating system distributions, backports of these changes are available in the flatpak-1.16.x branch.

Only install applications from trusted OCI registries. Flatpak remotes using the default OSTree transport are not affected.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Heap Buffer Overflow Vulnerability in Flatpak on 32-bit Systems A heap buffer overflow vulnerability, identified as CVE-2026-96280, affects the OCI delta stream parser in Flatpak on 32-bit systems. This flaw allows an attacker controlling an OCI registry to craft a malicious delta stream that can lead to arbitrary code execution during Flatpak installs or updates. The vulnerability arises from the parser reading sizes as guint64 but passing them to GLib functions expecting gsize, resulting in silent truncation and undersized memory allocations. The issue is only exploitable on 32-bit systems, as 64-bit systems do not experience this truncation. Users are advised to only install applications from trusted OCI registries, as the exploit requires user interaction. The vulnerability has been patched in version 1.18.1 of Flatpak. Current risk is high, particularly for systems using OCI-based Flatpak remotes on 32-bit platforms. The vulnerability was published on September 27, 2026. 3 sources 65

Extracted Entities

GHSA Jr92 2v97 Wgvc

The full story

Extracted Entities

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (4)