CVE-2026-96280

HighCVSS 7.5/10Last modified Oct 12, 2026

Description

The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-197

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 27, 2026
Last modified: Oct 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-962816.2On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing CVE-2026-962823.1A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host direc CVE-2026-962833.3By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from inter CVE-2026-962842.5A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI CVE-2026-962868.2Uncaught exception vulnerability in Apache Thrift Perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommende CVE-2026-962878.2Inefficient Algorithmic Complexity vulnerability in Apache Thrift Perl bindings. This issue affects Apache Thrift: before 0.25.0. User CVE-2026-962888.2Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings. This issue a CVE-2026-962898.2Uncontrolled Recursion vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recomme CVE-2026-96296.4The Canvas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' parameter in all versions up to, and including, 2 CVE-2026-962928.2Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue aff CVE-2026-962936.9A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a CVE-2026-962948.7Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache