Vulnerability in Red Hat Enterprise Linux 10

[ Description ]Official description

The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund11 Oct 2026WID-SEC-2026-3861

  Red Hat Enterprise Linux (flatpak): Multiple vulnerabilities Translated from German

  CVE-2026-90616CVE-2026-96808CVE-2026-86320+2 more CVEs

[ References ]References

• access.redhat.com/errata/RHSA-2026:80497
• access.redhat.com/errata/RHSA-2026:80498
• access.redhat.com/errata/RHSA-2026:80687
• access.redhat.com/security/cve/CVE-2026-96280
• bugzilla.redhat.com/show_bug.cgi
• github.com/flatpak/flatpak/security/advisories/GHSA-jr92-2v97-wgvc