High RHSA-2026:99010 4 CVEs

Red Hat Security Advisory: flatpak security update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 5

Release	Package	Fixed in
Red Hat · RHEL 7 ELS rhel_els:7	flatpak	0:1.12.9-6.el7_9
Red Hat · RHEL 7 ELS rhel_els:7	flatpak-builder	1:1.0.0-18.el7_9
Red Hat · RHEL 7 ELS rhel_els:7	flatpak-debuginfo	0:1.12.9-6.el7_9
Red Hat · RHEL 7 ELS rhel_els:7	flatpak-devel	0:1.12.9-6.el7_9
Red Hat · RHEL 7 ELS rhel_els:7	flatpak-libs	0:1.12.9-6.el7_9

Vulnerabilities 4

High 8.8

CVE-2026-96275

Flatpak: flatpak: arbitrary write access as root via extra-data extraction

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path o…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu

Sep 23, 2026
High 7.5

CVE-2026-96280

Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems

The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu

Sep 27, 2026
High 7.4

CVE-2026-90616

In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, wh…

Flatpak Flatpak flatpak flatpak Debian Ubuntu

Sep 12, 2026
High 7.4

CVE-2026-96808

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unpriv…

Flatpak Flatpak flatpak flatpak Debian Ubuntu

Sep 23, 2026

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2532613
report
https://bugzilla.redhat.com/show_bug.cgi?id=2539416
report
https://bugzilla.redhat.com/show_bug.cgi?id=2539419
report
https://bugzilla.redhat.com/show_bug.cgi?id=2539569
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_99010.json
report
https://access.redhat.com/security/cve/CVE-2026-90616
advisory
https://www.cve.org/CVERecord?id=CVE-2026-90616
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-90616
article
https://github.com/flatpak/flatpak/security/advisories/GHSA-8688-9x26-hhxj
article
https://www.openwall.com/lists/oss-security/2026/08/11/9
report
https://access.redhat.com/security/cve/CVE-2026-96275
advisory
https://www.cve.org/CVERecord?id=CVE-2026-96275
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-96275
article
https://github.com/flatpak/flatpak/security/advisories/GHSA-fqx6-vh4p-42cg
report
https://access.redhat.com/security/cve/CVE-2026-96280
advisory
https://www.cve.org/CVERecord?id=CVE-2026-96280
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-96280
article
https://github.com/flatpak/flatpak/security/advisories/GHSA-jr92-2v97-wgvc
report
https://access.redhat.com/security/cve/CVE-2026-96808
advisory
https://www.cve.org/CVERecord?id=CVE-2026-96808
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-96808
article
https://github.com/flatpak/flatpak/security/advisories/GHSA-qrwq-7qwx-q9rp