CVE-2026-48864
A flaw was found in libsolv.
Published May 26, 2026 · updated Oct 14, 2026 · opensuse libsolv
A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within files due to insufficient input validation. An attacker can provide a specially crafted file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or a denial of service.
Timeline
Detection, updates, and resolution for this record.
May 26, 2026 · NIST NVD
Detected
A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within files due to insufficient input validation. An attacker can provide a specially crafted file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or
Oct 14, 2026 · NIST NVD
Updated
A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within files due to insufficient input validation. An attacker can provide a specially crafted file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or
Affected
- cpe opensuse/libsolv0.7.36
- cpe redhat/enterprise linux7.0
- cpe redhat/enterprise linux8.0
- cpe redhat/enterprise linux9.0
- cpe redhat/hardened imagesversion unspecified
- cpe redhat/openshift container platform4.0
- cpe redhat/satellite6.0
- cpe redhat/update infrastructure4
Sources
- CVE.orgCVE-2026-48864
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-48864
30-day exploitation probability 0.3%
first.org - NIST NVDCVE-2026-48864
A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within files due to insufficient input validation. An attacker can provide a specially crafted file, which, when processed by a vulnerable
nvd.nist.gov