VulnerabilityModified
CVE-2026-9150
This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian repository metadata.
MEDIUM 6.5EPSS 0.41%
Does this matter?
Lower severity and a low EPSS score (0.41%). Track it; it rarely justifies an emergency change on its own.
Description
A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian repository metadata. An attacker could exploit this by providing malicious SHA384 or SHA512 checksum tags, leading to memory corruption and a denial of service (DoS) in the affected system.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- EPSS
- 0.41% probability · 34th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-121
- Affected
- opensuse/libsolv · redhat/hardened images · redhat/openshift container platform · redhat/satellite · redhat/update infrastructure · redhat/enterprise linux
- Source
- secalert@redhat.com
References
- https://access.redhat.com/errata/RHSA-2026:21333
- https://access.redhat.com/errata/RHSA-2026:28236
- https://access.redhat.com/errata/RHSA-2026:30649
- https://access.redhat.com/errata/RHSA-2026:48818
- https://access.redhat.com/security/cve/CVE-2026-9150Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2460379Issue Tracking, Third Party Advisory
- https://github.com/openSUSE/libsolv/pull/616Issue Tracking, Patch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.