High [CVE-2026-96280] Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems

The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows.

An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems. Red Hat estimates the CVSSv3.1 vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.

The malicious stream is served over the network (AV:N), and the attacker needs only control over the OCI registry content (PR:N). This overflow only manifests on 32-bit targets — on 64-bit systems gsize and guint64 are the same width and truncation does not occur, so exploitability depends on a target configuration outside the attacker's control (AC:H).

Meaningful user interaction is required (UI:R). The vulnerable and impacted components remain within the same flatpak client/helper security authority (S:U).

Because this is a heap buffer overflow with a stated path to code execution in the Flatpak client process, a successful exploit is treated as a full compromise of that process's privileges (C:H/I:H/A:H). Red Hat severity: Moderate — CVSS 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

Weakness: CWE-197.