Log in Start free

Vulnerability · Published May 20, 2026 · Assigned by redhat

CVE-2026-9149Libsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file

Medium 6.5

In plain English

A medium-severity heap buffer overflow in Red Hat Enterprise Linux 10 from Red Hat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 75.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this to cause a denial of service (DoS).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10libsolv0.7.33-5.el10_2.alma.1ALSA-2026:28236
AlmaLinux:10libsolv-devel0.7.33-5.el10_2.alma.1ALSA-2026:28236
AlmaLinux:10libsolv-tools0.7.33-5.el10_2.alma.1ALSA-2026:28236
AlmaLinux:10libsolv-tools-base0.7.33-5.el10_2.alma.1ALSA-2026:28236
AlmaLinux:10python3-solv0.7.33-5.el10_2.alma.1ALSA-2026:28236
Debian:12libsolvno fix listedDEBIAN-CVE-2026-9149
Debian:13libsolvno fix listedDEBIAN-CVE-2026-9149
Debian:14libsolv0.7.38-1DEBIAN-CVE-2026-9149
Rocky Linux:10libsolv0:0.7.33-5.el10_2RLSA-2026:28236
Ubuntu:22.04:LTSlibsolvno fix listedUBUNTU-CVE-2026-9149
Ubuntu:24.04:LTSlibsolvno fix listedUBUNTU-CVE-2026-9149
Ubuntu:25.10libsolvno fix listedUBUNTU-CVE-2026-9149
Ubuntu:26.04:LTSlibsolvno fix listedUBUNTU-CVE-2026-9149
Ubuntu:26.10libsolvno fix listedUBUNTU-CVE-2026-9149

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support see references
Red Hat Red Hat Hardened Images see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat Satellite 6 see references
Red Hat Red Hat Update Infrastructure 4 for Cloud Providers see references

Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References