The OCI delta stream parser in Flatpak reads file sizes as 64‑bit values but passes them to GLib I/O and allocation functions that expect a 32‑bit size on 32‑bit systems. This mismatch creates undersized memory allocations while subsequent operations still use the original 64‑bit value, resulting in a heap buffer overflow. An attacker who controls the OCI registry can craft a malicious delta stream that triggers the overflow during a Flatpak install or update, potentially allowing the attacker to execute arbitrary code on affected systems.

This flaw applies to installations of Flatpak on 32‑bit Red Hat Enterprise Linux 10, 7, 8, and 9. The vulnerability is limited to 32‑bit architectures; 64‑bit instances are not affected. The default OSTree transport remotes are not impacted, and only applications from trusted OCI registries pose a risk.

Because the vulnerability can lead to code execution and the attacker only needs to supply a crafted OCI registry stream, the risk is high for systems that pull Flatpak packages from potentially untrusted registries. The EPSS score is unavailable and the vulnerability is not currently listed in the CISA KEV catalog, but the potential impact and lack of a 64‑bit mitigation path make it a serious concern for organizations relying on 32‑bit RHEL editions.