Search: CVE-2026-96280

CVE-2026-96280 is a numeric truncation vulnerability in the OCI delta stream parser used by Flatpak on Red Hat Enterprise Linux 10 32-bit systems. The parser reads sizes as 64-bit values but passes them to functions expecting 32-bit sizes, causing undersized memory allocations and subsequent heap buffer overflows. An attacker controlling an OCI registry can exploit this during Flatpak install or update operations, potentially achieving code execution on affected 32-bit systems.