CVE-2026-96280 in Red Hat
Summary
by MITRE • 09/28/2026
The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/28/2026
The vulnerability in question stems from a critical type mismatch within the OCI delta stream parser of Flatpak, specifically involving the handling of data sizes for memory allocation and I/O operations. The core technical flaw lies in the fact that while the parser correctly reads size values as guint64 variables to accommodate large files on modern 64-bit architectures, it subsequently passes these values directly to GLib functions such as g_malloc or similar I/O routines which expect a gsize type. On 32-bit systems, where gsize is defined as a 32-bit unsigned integer (guint32), this implicit conversion results in the truncation of high-order bits if the original size exceeds four gigabytes. This truncation causes the system to allocate a heap buffer that is significantly smaller than what is actually required by the subsequent data processing logic, which continues to operate under the assumption that the full 64-bit size is available for writing.
This discrepancy creates a classic heap-based buffer overflow condition. When the application proceeds to write or process the delta stream data using the original large size value against the undersized allocated memory region, it writes beyond the boundaries of the allocated buffer into adjacent memory spaces. Such out-of-bounds writes can corrupt internal data structures, overwrite function pointers, or manipulate control flow mechanisms within the heap metadata. In a 32-bit environment, where address space is more constrained and exploitation techniques are often more straightforward due to predictable memory layouts, this flaw presents a severe risk of arbitrary code execution. An attacker who controls an OCI registry can craft a malicious delta stream with carefully chosen size headers that trigger this truncation and subsequent overflow during the installation or update process managed by Flatpak.
The operational impact is particularly acute for users running 32-bit operating systems, as they are directly susceptible to remote code execution via compromised software repositories. Even on 64-bit systems, while gsize typically matches guint64, ensuring no truncation occurs in most cases, the presence of such a type mismatch indicates poor defensive coding practices that could lead to other undefined behaviors or potential issues if platform-specific definitions change or if specific edge cases involving intermediate conversions are encountered. The vulnerability effectively allows an attacker who can influence the content of OCI registries used by Flatpak clients to escalate privileges and execute arbitrary code on vulnerable hosts, compromising system integrity and confidentiality.
From a classification perspective, this issue aligns with CWE-131: Incorrect Calculation of Buffer Size, as the application fails to correctly calculate or handle the size of the buffer required for its operation due to type conversion errors. It also relates closely to CWE-787: Out-of-bounds Write, which describes writing data past the end or before the beginning of the intended buffer. In terms of adversary tactics and techniques, this vulnerability facilitates exploitation through MITRE ATT&CK technique T1190: Exploit Public-Facing Application, as it leverages a flaw in an application that is exposed to external inputs from OCI registries. Furthermore, the initial access vector involves T1583: Acquire Infrastructure, where attackers compromise or control registry infrastructure to distribute malicious payloads.
Mitigation strategies must focus on both immediate code remediation and broader architectural improvements. Developers should enforce explicit type casting with bounds checking when converting between guint64 and gsize, ensuring that any value exceeding the maximum capacity of a 32-bit integer is either rejected outright or handled via split operations if supported by the underlying library functions. Implementing static analysis tools configured to detect implicit narrowing conversions can help identify similar issues across the codebase before deployment. Additionally, enabling Address Sanitizer (ASan) during testing phases would have likely detected this out-of-bounds write condition early in the development lifecycle. For end-users, restricting Flatpak installations to trusted and verified OCI registries reduces the attack surface by limiting exposure to untrusted sources that might host crafted delta streams designed to exploit this specific memory corruption flaw.