Memory Integrity Issue in libsolv Affecting RPM-Based Package Managers

CVE-2026-82327

What is CVE-2026-82327?

A vulnerability exists in libsolv, utilized by major RPM-based package managers, that allows for an out-of-bounds memory write due to improper validation of directory-id values from compressed .solv cache files. This flaw can lead to a denial of service when tools like dnf, yum, or zypper attempt to process a corrupted or specially crafted .solv cache file. Although the exploit is expected to cause tool crashes, it does not allow for arbitrary code execution, as the out-of-bounds write is limited to a fixed value that cannot be manipulated by an attacker.

References