Summary
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
* flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)
* flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)
* flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)
* flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | flatpak | 1.12.9-7.el8_10 |
| AlmaLinux · 8 | flatpak-devel | 1.12.9-7.el8_10 |
| AlmaLinux · 8 | flatpak-libs | 1.12.9-7.el8_10 |
| AlmaLinux · 8 | flatpak-selinux | 1.12.9-7.el8_10 |
| AlmaLinux · 8 | flatpak-session-helper | 1.12.9-7.el8_10 |
Vulnerabilities 4
-
High 8.8
Flatpak: flatpak: arbitrary write access as root via extra-data extraction
A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path o…
-
High 7.5
Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems
The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer…
-
High 7.4
In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, wh…
-
High 7.4
In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unpriv…
References
-
report
https://access.redhat.com/security/cve/CVE-2026-90616
-
report
https://access.redhat.com/security/cve/CVE-2026-96275
-
report
https://access.redhat.com/security/cve/CVE-2026-96280
-
report
https://access.redhat.com/security/cve/CVE-2026-96808
-
report
https://bugzilla.redhat.com/2532613
-
report
https://bugzilla.redhat.com/2539416
-
report
https://bugzilla.redhat.com/2539419
-
report
https://bugzilla.redhat.com/2539569
-
advisory
https://errata.almalinux.org/8/ALSA-2026-80687.html