Libsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file

Summary

CVE	CVE-2026-9149
State	PUBLISHED
Assigner	redhat
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-05-21 00:16:35 UTC
Updated	2026-06-02 01:21:26 UTC
Description	A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this to cause a denial of service (DoS).

Risk And Classification

Primary CVSS: v3.1 6.5 MEDIUM from [email protected]

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS: 0.000580000 probability, percentile 0.183340000 (date 2026-05-27)

Problem Types: CWE-122 | CWE-122 Heap-based Buffer Overflow

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Primary	6.5	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H`
3.1	[email protected]	Secondary	6.5	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H`
3.1	CNA	CVSS	6.5	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H`

CVSS v3.1 Breakdown

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Opensuse	Libsolv	All	All	All	All
Operating System	Redhat	Enterprise Linux	10.0	All	All	All
Operating System	Redhat	Enterprise Linux	7.0	All	All	All
Operating System	Redhat	Enterprise Linux	8.0	All	All	All
Operating System	Redhat	Enterprise Linux	9.0	All	All	All
Application	Redhat	Hardened Images	-	All	All	All
Application	Redhat	Openshift Container Platform	4.0	All	All	All
Application	Redhat	Satellite	6.0	All	All	All
Application	Redhat	Update Infrastructure	4	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Red Hat	Red Hat Enterprise Linux 10	Not specified	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 7	Not specified	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 8	Not specified	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 9	Not specified	Not specified
CNA	Red Hat	Red Hat Hardened Images	Not specified	Not specified
CNA	Red Hat	Red Hat OpenShift Container Platform 4	Not specified	Not specified
CNA	Red Hat	Red Hat Satellite 6	Not specified	Not specified
CNA	Red Hat	Red Hat Update Infrastructure 4 For Cloud Providers	Not specified	Not specified

References

Reference	Source	Link	Tags
github.com/openSUSE/libsolv/pull/617	134c704f-9b21-4f2e-91b3-4a467353bcc0	github.com	Issue Tracking, Patch
bugzilla.redhat.com/show_bug.cgi	[email protected]	bugzilla.redhat.com	Issue Tracking, Third Party Advisory
access.redhat.com/security/cve/CVE-2026-9149	[email protected]	access.redhat.com	Third Party Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Vendor Comments And Credit

Discovery Credit

CNA: This issue was discovered by AISLE in partnership with Red Hat. (en)

Additional Advisory Data

Source	Time	Event
CNA	2026-04-21T21:20:01.000Z	Reported to Red Hat.
CNA	2026-05-20T22:19:32.560Z	Made public.

Workarounds

CNA: To mitigate this issue, avoid processing untrusted `.solv` files with libsolv or any applications that consume `.solv` input. Ensure that all `.solv` data processed by the system originates from trusted sources only.

There are currently no legacy QID mappings associated with this CVE.