CVE-2026-9149
published 2026-05-21CVE-2026-9149: A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size…
PriorityP434medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.31%
23.6th percentile
A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this to cause a denial of service (DoS).
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| opensuse | libsolv | <= 0.7.36 | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | openshift_container_platform | — | — |
| redhat | satellite | — | — |
| redhat | update_infrastructure | — | — |
| satellite-capsule_el8 | libsolv | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
libsolv solv File repo_add_solv heap-based overflow (EUVD-2026-31201 / CNNVD-202605-4475)
vuldb·2026-05-22·CVSS 6.5
CVE-2026-9149 [MEDIUM] libsolv solv File repo_add_solv heap-based overflow (EUVD-2026-31201 / CNNVD-202605-4475)
A vulnerability described as critical has been identified in libsolv. This impacts the function repo_add_solv of the component solv File Handler. Executing a manipulation can lead to heap-based buffer overflow.
This vulnerability appears as CVE-2026-9149. The attack may be performed from remote. There is no available exploit.
A patch should be applied to remediate this issue.
GHSA
GHSA-9q56-xf64-q987: A flaw was found in libsolv
ghsa_unreviewed·2026-05-21
CVE-2026-9149 [MEDIUM] CWE-122 GHSA-9q56-xf64-q987: A flaw was found in libsolv
A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this to cause a denial of service (DoS).
Red Hat
libsolv: Heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file
vendor_redhat·2026-05-20·CVSS 6.5
CVE-2026-9149 [MEDIUM] CWE-122 libsolv: Heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file
libsolv: Heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file
MANUALLY_VERIFIED_REPORT
package: libsolv-0.7.33-2.el10
[Security] Heap Buffer Overflow in repo_add_solv via Negative maxsize
Summary: Heap buffer overflow in `repo_add_solv` when parsing attacker-controlled `.solv` files; large encoded `maxsize`/`allsize` header values can decode to negative signed `Id` values, leading to undersized heap allocation while a subsequent `fread` uses `DATA_READ_CHUNK` (8192) bytes.
Requirements to exploit: Ability to supply a crafted `.solv` file that a victim processes with libsolv (directly or via a consumer such as `dumpsolv` or an application that calls `repo_add_solv` on untrusted input).
Component affected: libsolv
Version affected: = TBD
CVSS: 6.5 (Medi
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-82327 libsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist data
bugzilla·2026-08-28·CVSS 5.5
CVE-2026-82327 [MEDIUM] CVE-2026-82327 libsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist data
CVE-2026-82327 libsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist data
libsolv is a dependency-resolution library used by dnf/libdnf, zypper/libzypp, and other RPM-based package managers. It serializes parsed repository metadata into a binary cache format (.solv files) to avoid re-parsing repository XML on every run. repo_write() (src/repo_write.c) rewrites such a cache from an in-memory Repo/Repodata, in two passes: pass 1 (collect_needed_cb) collects which directory ids are used, and pass 2 (collect_data_cb / collect_filelist_cb) emits the serialized data.
Root cause: in collect_needed_cb() (src/repo_write.c:614-683), for REPOKEY_TYPE_DIR / REPOKEY_TYPE_DIRNUMNUMARRAY / REPOKEY_TYPE_DIRSTRARRAY keys, the code executes `
Bugzilla
CVE-2026-9149 libsolv: Heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file
bugzilla·2026-04-21·CVSS 6.5
CVE-2026-9149 [MEDIUM] CVE-2026-9149 libsolv: Heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file
CVE-2026-9149 libsolv: Heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file
MANUALLY_VERIFIED_REPORT
package: libsolv-0.7.33-2.el10
[Security] Heap Buffer Overflow in repo_add_solv via Negative maxsize
Summary: Heap buffer overflow in `repo_add_solv` when parsing attacker-controlled `.solv` files; large encoded `maxsize`/`allsize` header values can decode to negative signed `Id` values, leading to undersized heap allocation while a subsequent `fread` uses `DATA_READ_CHUNK` (8192) bytes.
Requirements to exploit: Ability to supply a crafted `.solv` file that a victim processes with libsolv (directly or via a consumer such as `dumpsolv` or an application that calls `repo_add_solv` on untrusted input).
Component affected: libsolv
Version affected: =
https://access.redhat.com/errata/RHSA-2026:21333https://access.redhat.com/errata/RHSA-2026:28236https://access.redhat.com/errata/RHSA-2026:48818https://access.redhat.com/security/cve/CVE-2026-9149https://bugzilla.redhat.com/show_bug.cgi?id=2460380https://github.com/openSUSE/libsolv/pull/617https://github.com/openSUSE/libsolv/pull/617
2026-05-21
Published