CoreCVE
Back

MEDIUM

Libsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file

Published May 20, 2026

Description

A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this to cause a denial of service (DoS).

Affected products

Remediation

Vendor solution

To mitigate this issue, avoid processing untrusted `.solv` files with libsolv or any applications that consume `.solv` input. Ensure that all `.solv` data processed by the system originates from trusted sources only.

Red Hat statement

This Moderate impact heap buffer overflow in libsolv occurs when processing specially crafted `.solv` files with negative size values. Exploitation requires a victim to process attacker-controlled input, such as an untrusted `.solv` file, which can lead to a denial of service. The vulnerability is not easily exploitable without user interaction or specific application workflows that handle untrusted solvdb inputs.

Red Hat mitigation

To mitigate this issue, avoid processing untrusted `.solv` files with libsolv or any applications that consume `.solv` input. Ensure that all `.solv` data processed by the system originates from trusted sources only.

Weaknesses (1)

CWE-122

References (8)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published May 20, 2026
Updated Sep 1, 2026
Reserved May 20, 2026
Link CVE-2026-9149
CISA Vulnrichment
Updated May 21, 2026
NVD
Status Modified
Modified Sep 1, 2026
Link CVE-2026-9149
Red Hat
Severity Moderate
Public date May 20, 2026
Links CVE-2026-9149 - Bugzilla