SB2026101248 - Red Hat Enterprise Linux 8 update for flatpak

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101248

SB2026101248 - Red Hat Enterprise Linux 8 update for flatpak

Published: October 12, 2026

Security Bulletin ID SB2026101248
CSH Severity
High
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 25% Medium 50% Low 25%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Link following (CVE-ID: CVE-2026-90616)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to access arbitrary files on the host filesystem and potentially execute arbitrary code on the host.

The vulnerability exists due to improper link resolution in app data directory setup and bind mounts when creating and mounting attacker-controlled sandbox paths. A remote user can create a malicious symlink to redirect a bind-mounted directory to an arbitrary host location to access arbitrary files on the host filesystem and potentially execute arbitrary code on the host.

Exploitation requires a malicious sandboxed app.


2) Path traversal (CVE-ID: CVE-2026-96275)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to write attacker-controlled content to arbitrary locations on the host filesystem.

The vulnerability exists due to path traversal in extract_extra_data when extracting extra-data from a malicious or compromised Flatpak repository. A remote attacker can provide a repository containing a symlinked files entry to write attacker-controlled content to arbitrary locations on the host filesystem.

On system installs, the write occurs with root permissions.


3) Heap-based buffer overflow (CVE-ID: CVE-2026-96280)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in the OCI delta stream parser when processing a crafted delta stream from a malicious OCI registry during installation or update. A remote attacker can supply a specially crafted OCI delta stream to execute arbitrary code.

Only 32-bit systems are practically exploitable. Flatpak remotes using the default OSTree transport are not affected.


4) Path traversal (CVE-ID: CVE-2026-96808)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to path traversal in the revokefs writer when processing repository data from unprivileged callers via symlink traversal between revokefs sessions. A local user can create a symlink between two revokefs sessions and retain a file descriptor to tamper with validated commit data to escalate privileges.

Exploitation requires an active local session and access to operations permitted by the system helper.


Remediation

Install update from vendor's website.

References