Log in Start free

Vulnerability · Published Sep 29, 2026 · Assigned by redhat

CVE-2026-95520Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages

High 7.1

In plain English

A high-severity out-of-bounds write in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.1%top 98.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12rpmno fix listedDEBIAN-CVE-2026-95520
Debian:13rpmno fix listedDEBIAN-CVE-2026-95520
Debian:14rpmno fix listedDEBIAN-CVE-2026-95520
Ubuntu:22.04:LTSrpmno fix listedUBUNTU-CVE-2026-95520
Ubuntu:24.04:LTSrpmno fix listedUBUNTU-CVE-2026-95520
Ubuntu:26.04:LTSrpmno fix listedUBUNTU-CVE-2026-95520
Ubuntu:26.10rpmno fix listedUBUNTU-CVE-2026-95520

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Hardened Images see references

Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

References