Red Hat Security Advisory: flatpak security update

Fixed packages 18

Vulnerabilities 4

• High 8.8
  CVE-2026-96275

  Flatpak: flatpak: arbitrary write access as root via extra-data extraction

  A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path o…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu
  Sep 23, 2026
• High 7.5
  CVE-2026-96280

  Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems

  The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu
  Sep 27, 2026
• High 7.4
  CVE-2026-90616

  In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, wh…

  Flatpak Flatpak flatpak flatpak Debian Ubuntu
  Sep 12, 2026
• High 7.4
  CVE-2026-96808

  In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unpriv…

  Flatpak Flatpak flatpak flatpak Debian Ubuntu
  Sep 23, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2532613
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2539416
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2539419
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2539569
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98112.json
• report
  https://access.redhat.com/security/cve/CVE-2026-90616
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-90616
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-90616
• article
  https://github.com/flatpak/flatpak/security/advisories/GHSA-8688-9x26-hhxj
• article
  https://www.openwall.com/lists/oss-security/2026/08/11/9
• report
  https://access.redhat.com/security/cve/CVE-2026-96275
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-96275
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-96275
• article
  https://github.com/flatpak/flatpak/security/advisories/GHSA-fqx6-vh4p-42cg
• report
  https://access.redhat.com/security/cve/CVE-2026-96280
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-96280
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-96280
• article
  https://github.com/flatpak/flatpak/security/advisories/GHSA-jr92-2v97-wgvc
• report
  https://access.redhat.com/security/cve/CVE-2026-96808
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-96808
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-96808
• article
  https://github.com/flatpak/flatpak/security/advisories/GHSA-qrwq-7qwx-q9rp