CVE-2026-9149

A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache files. When libsolv rewrites a .solv cache file, it reads directory-id values from the file's compressed filelist data without validating that they fall within the expected range. A corrupted or specially crafted .solv cache file (for example, one left in a torn state after an unclean system shutdown) can cause an out-of-bounds memory write when a tool such as dnf, yum, or zypper next processes it. Successful exploitation is expected to result in a crash of the affected tool (denial of service); it is not expected to allow arbitrary code execution because the out-of-bounds write always stores a fixed, non-attacker-controlled value.

A stack-based buffer overflow vulnerability was found in the libsolv library within the PGP verification component. The flaw is caused by incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker can craft a malicious Ed25519 PGP signature with mismatched MPI lengths, leading to denial of service in automated package or repository processing workflows.

libsolv has a heap buffer overflow vulnerability during decompression of attacker-controlled compressed data in .solv files due to insufficient input validation. A crafted .solv file can lead to out-of-bounds memory access, potentially causing information disclosure, program execution alteration, or denial of service.

In libsolv, a stack-based buffer overflow vulnerability exists in the Debian metadata parser when processing specially crafted Debian repository metadata. An attacker can provide malicious SHA384 or SHA512 checksum tags, leading to memory corruption and denial of service (DoS).