CVE-2026-96280

The record

The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems.

Affected packages

Related vulnerabilities

• CVE-2026-116742 HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability in… CWE-197
• CVE-2026-116012 Ghidra before 12.2 contains a numeric truncation vulnerability in… CWE-197
• CVE-2026-115889 Wasmtime is a runtime for WebAssembly. CWE-197
• CVE-2026-70177 Numeric truncation error in Microsoft Windows Search Component allows an authorized… CWE-197
• CVE-2026-70123 Numeric truncation error in Microsoft Graphics Component allows an authorized attacker to… CWE-197
• CVE-2026-19667 If an attacker-controlled authoritative server can produce a negative answer that is… CWE-197
• CVE-2026-87529 Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowed a… CWE-197
• CVE-2026-68880 Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate… CWE-197