Critical Heap Buffer Overflow Vulnerability in Flatpak on 32-bit Systems

• •CVE-2026-96280 allows arbitrary code execution on 32-bit systems via Flatpak.
• •The vulnerability is due to numeric truncation leading to heap buffer overflows.
• •Patches are available in Flatpak version 1.18.1; users should restrict OCI remotes.

A heap buffer overflow vulnerability, identified as CVE-2026-96280, affects the OCI delta stream parser in Flatpak on 32-bit systems. This flaw allows an attacker controlling an OCI registry to craft a malicious delta stream that can lead to arbitrary code execution during Flatpak installs or updates. The vulnerability arises from the parser reading sizes as guint64 but passing them to GLib functions expecting gsize, resulting in silent truncation and undersized memory allocations. The issue is only exploitable on 32-bit systems, as 64-bit systems do not experience this truncation. Users are advised to only install applications from trusted OCI registries, as the exploit requires user interaction. The vulnerability has been patched in version 1.18.1 of Flatpak. Current risk is high, particularly for systems using OCI-based Flatpak remotes on 32-bit platforms. The vulnerability was published on September 27, 2026.