CVE-2026-48863
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
A stack-based buffer overflow vulnerability was found in the libsolv library within the PGP verification component. The flaw is caused by incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker can craft a malicious Ed25519 PGP signature with mismatched MPI lengths, leading to denial of service in automated package or repository processing workflows.
Risk Assessment
The risk involves the potential for remote denial of service (DoS) in systems using libsolv for automated package or repository processing. An attacker can disrupt critical workflows, such as software updates, without requiring authentication.
Recommendation
Immediately update libsolv to a patched version that addresses this vulnerability. In the interim, restrict processing of untrusted PGP signatures and implement monitoring for anomalies in workflow operations.
Other vulnerabilities in libsolv
See all- CVE-2026-82327Medium
A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache files. When libsolv rewrites a .solv cache file, it reads directory-id values from the file's compressed filelist data without validating that they fall within the expected range. A corrupted or specially crafted .solv cache file (for example, one left in a torn state after an unclean system shutdown) can cause an out-of-bounds memory write when a tool such as dnf, yum, or zypper next processes it. Successful exploitation is expected to result in a crash of the affected tool (denial of service); it is not expected to allow arbitrary code execution because the out-of-bounds write always stores a fixed, non-attacker-controlled value.
- CVE-2026-48864High
libsolv has a heap buffer overflow vulnerability during decompression of attacker-controlled compressed data in .solv files due to insufficient input validation. A crafted .solv file can lead to out-of-bounds memory access, potentially causing information disclosure, program execution alteration, or denial of service.
- CVE-2026-9149Medium
A heap buffer overflow vulnerability has been found in the libsolv library when processing a specially crafted .solv file with negative size values in the repo_add_solv function. This leads to undersized memory allocation and out-of-bounds write, which can be exploited for a DoS attack.
- CVE-2026-9150Medium
In libsolv, a stack-based buffer overflow vulnerability exists in the Debian metadata parser when processing specially crafted Debian repository metadata. An attacker can provide malicious SHA384 or SHA512 checksum tags, leading to memory corruption and denial of service (DoS).
Original NVD description (English source)
A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI lengths. Processing this crafted signature could lead to a denial of service in automated package or repository processing workflows.