The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade flatpak-selinuxUpgrade flatpakUpgrade flatpak-session-helperUpgrade flatpak-develUpgrade flatpak-libs | Oct 12, 2026 | Oct 12, 2026 |
| Redhat_linux | — | Upgrade flatpak-libsUpgrade flatpak-tests-debuginfoUpgrade flatpak-session-helper-debuginfoUpgrade flatpak-debuginfoUpgrade flatpak-selinuxNo solution existsUpgrade flatpak-libs-debuginfoUpgrade flatpakUpgrade flatpak-develUpgrade flatpak-session-helperUpgrade flatpak-debugsource | Sep 29, 2026 | Aug 11, 2026 |
| Rocky_linux | — | Upgrade flatpakUpgrade flatpak-session-helper-debuginfoUpgrade flatpak-libsUpgrade flatpak-libs-debuginfoUpgrade flatpak-session-helperUpgrade flatpak-debuginfoUpgrade flatpak-debugsourceUpgrade flatpak-devel | Oct 15, 2026 | Oct 13, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub