The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade flatpak-develUpgrade flatpak-libsUpgrade flatpak-session-helperUpgrade flatpakUpgrade flatpak-selinux | Oct 12, 2026 | Oct 12, 2026 |
| Oracle_linux | — | Upgrade flatpakUpgrade flatpak-develUpgrade flatpak-selinuxUpgrade flatpak-libsUpgrade flatpak-session-helper | Oct 22, 2026 | Sep 27, 2026 |
| Redhat_linux | — | Upgrade flatpakUpgrade flatpak-debuginfoUpgrade flatpak-session-helperUpgrade flatpak-debugsourceUpgrade flatpak-selinuxUpgrade flatpak-libs-debuginfoNo solution existsUpgrade flatpak-develUpgrade flatpak-libsUpgrade flatpak-tests-debuginfoUpgrade flatpak-session-helper-debuginfo | Sep 29, 2026 | Aug 11, 2026 |
| Rocky_linux | — | Upgrade flatpak-session-helperUpgrade flatpak-debugsourceUpgrade flatpak-debuginfoUpgrade flatpak-develUpgrade flatpak-libsUpgrade flatpak-libs-debuginfoUpgrade flatpak-session-helper-debuginfoUpgrade flatpak | Oct 15, 2026 | Oct 13, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub