Heap Buffer Overflow in libsolv Affects Open Source Package Management Tools
CVE-2026-9149
6.5MEDIUM
What is CVE-2026-9149?
A vulnerability exists in libsolv that leads to a heap buffer overflow. This flaw arises when processing a specially crafted .solv file with negative size values in the repo_add_solv function. The resulting undersized memory allocation allows for out-of-bounds writes, which attackers could exploit to induce a denial of service condition. This vulnerability poses significant risks to systems relying on libsolv for package management.
References
CVSS V3.1
Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
This issue was discovered by Found by AISLE in partnership with Red Hat.