Executive brief
libsolv is a library used by package managers (like DNF and Zypper) to resolve software dependencies. A vulnerability in how it handles compressed repository metadata files (.solv) could allow an attacker to crash the package manager or potentially execute unauthorized code. To exploit this, an attacker would need to trick a user or system into processing a specially crafted, malicious repository file.
Technical details
A heap buffer overflow exists in libsolv within the repopagestore_load_page_range and repopagestore_read_or_setup_pages functions in src/repopage.c. The vulnerability is caused by the use of unchecked_decompress_buf, which decompresses attacker-controlled .solv page data without validating the output length or back-reference safety against the REPOPAGE_BLOBSIZE (32 KB) limit. An attacker can provide a crafted .solv file with malicious compressed streams to trigger out-of-bounds reads and writes. This can lead to information disclosure, denial of service, or arbitrary code execution when a victim application parses the malicious metadata. While a patch has been proposed to use check_decompress_buf for pre-validation, upstream maintainers have expressed disagreement regarding the security impact classification.
Affected products
- Red Hat libsolv 0.7.36
Timeline
- 2026-04-21: other: Initial report via OSIDB Bzimport
- 2026-05-25: other: Upstream acknowledgment of flaw with severity disagreement
- 2026-05-26: advisory: NVD publication date