Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Stage malicious .solv on attacker-controlled repo or mirror
  2. Delivery
    Lure victim or pipeline to sync metadata
  3. Exploit
    libsolv decompresses crafted compressed blob
  4. Execution
    Heap buffer overflow during parsing
  5. Persist
    Memory corruption alters execution or leaks data
  6. Impact
    Code execution or DoS in package tooling context

Vulnerability Assessment

Weakness
CWE
CWE-787
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the victim to process an attacker-controlled .solv repository metadata file through a libsolv-linked tool such as DNF, Zypper, microdnf, or repository tooling inside OpenShift/Satellite - this is the UI:R condition. The attacker does not need credentials on the target (PR:N), but they must place the malicious .solv file where it will be parsed: a compromised or malicious package repository, a poisoned mirror, an untrusted container build context, or a crafted artifact ingested by an automated sync. Exploitation is limited by AV:L (the file must reach the local parser, not a remote network endpoint) and by SSVC Automatable=no, meaning each compromise generally requires per-target setup rather than wormable mass exploitation; systems that only consume signed, vendor-operated repositories are at substantially lower practical risk.
Impact

The CVSS 7.8 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates local attack vector with required user interaction, which constrains real-world exploitability - a victim must process the malicious .solv file through a libsolv-consuming tool. SSVC corroborates this with Exploitation=poc, Automatable=no, and Technical Impact=total, suggesting that while compromise is severe per host, mass exploitation is unlikely. EPSS at 0.01% (3rd percentile) aligns with this picture, and the vulnerability is not on CISA KEV. The dissonance worth noting: PR:N combined with UI:R is unusual - it implies no authentication is needed by the attacker, but a privileged local user (often root, since package operations typically run elevated) must trigger the parsing, which actually amplifies impact when the trigger occurs in automated update flows or container build pipelines. This is a real but non-urgent priority: patch in the normal cycle, prioritized higher for systems that ingest third-party or untrusted .solv content (e.g., custom repositories, build hosts).
Exploit ScenarioDerived

An attacker hosts a malicious package repository or supplies a tampered .solv cache file (for example, via a compromised mirror, a poisoned container build context, or a crafted artifact in a CI pipeline). When a developer or administrator runs a package operation - such as DNF/Zypper repository refresh, an OpenShift image build, or a Satellite sync - libsolv parses the crafted compressed metadata and the heap buffer overflow triggers, yielding memory corruption that can disclose memory contents, alter execution, or crash the process. Public exploit code is not identified at time of analysis, but SSVC notes a proof-of-concept exists.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 08, 2026

Heap buffer overflow in libsolv allows local attackers to corrupt memory when a vulnerable application processes a maliciously crafted .solv repository metadata file. The flaw stems from insufficient input validation during decompression of attacker-controlled data, enabling information disclosure, control-flow alteration, or denial of service across multiple Red Hat Enterprise Linux releases and SUSE distributions. SSVC marks exploitation as PoC-level with total technical impact, while EPSS remains very low at 0.01%, indicating limited probability of widespread exploitation despite high severity.

RemediationAI

Apply the vendor-released patch by updating libsolv to the fixed package version delivered in RHSA-2026:21333 (https://access.redhat.com/errata/RHSA-2026:21333) and the corresponding SUSE security updates for openSUSE/SLES streams; rebuild or repull affected container images (OpenShift, Hardened Images) so the patched libsolv propagates into running workloads. Where immediate patching is not possible, restrict the systems that consume .solv data to trusted, signed repositories only and avoid running package operations against untrusted repository metadata, accepting the trade-off that internal or third-party mirrors may need re-verification. On Satellite and Red Hat Update Infrastructure hosts, treat repository sync sources as a sensitive trust boundary and audit any custom upstreams; in container build pipelines, avoid mounting or processing externally supplied .solv caches until libsolv is updated. Additional advisory context is available at https://access.redhat.com/security/cve/CVE-2026-48864 and https://bugzilla.redhat.com/show_bug.cgi?id=2460425.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libsolv is a widely used dependency-solver library originally developed by SUSE and adopted across RPM-based ecosystems (Red Hat, Fedora, openSUSE) for package metadata handling. The .solv file format is a compressed binary representation of repository metadata consumed by package managers such as DNF, Zypper, and tooling embedded in OpenShift, Satellite, and Red Hat Update Infrastructure. The root cause maps to CWE-787 (Out-of-bounds Write): the decompression routine trusts size or offset fields from the input stream without sufficient bounds checking, allowing a crafted compressed blob to overflow a heap buffer during parsing. Affected CPEs span Red Hat Enterprise Linux 7, 8, 9, and 10, Red Hat Hardened Images, OpenShift Container Platform 4, Satellite 6, and Red Hat Update Infrastructure 4, reflecting libsolv's pervasive role in package and image management pipelines.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 7.8 MEDIUM

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within .solv files due to insufficient input validation. An attacker can provide a specially crafted .solv file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or a denial of service.

Executive ViewAI

Why It Matters

A memory corruption vulnerability in libsolv, the package management system underlying Red Hat Enterprise Linux and SUSE distributions, allows local users to crash systems or steal sensitive system data. Organizations running this infrastructure must apply vendor patches immediately to maintain system stability and data protection.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 97% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
Poc
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_hardened_images:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_satellite_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_update_infrastructure_4_for_cloud_providers:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.4 Fixed
SUSE Linux Enterprise Micro 5.5 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-48864 ADVISORY https://vuldb.com/vuln/365713 REF https://access.redhat.com/errata/RHSA-2026:21333 REF https://access.redhat.com/errata/RHSA-2026:28236 REF https://access.redhat.com/errata/RHSA-2026:36730 REF https://access.redhat.com/errata/RHSA-2026:39315 REF https://access.redhat.com/errata/RHSA-2026:44481 REF https://access.redhat.com/errata/RHSA-2026:46836 REF https://access.redhat.com/errata/RHSA-2026:48811 REF https://access.redhat.com/errata/RHSA-2026:48813 REF https://access.redhat.com/errata/RHSA-2026:48814 REF https://access.redhat.com/errata/RHSA-2026:48815 REF https://access.redhat.com/errata/RHSA-2026:48816 REF https://access.redhat.com/errata/RHSA-2026:48817 REF https://access.redhat.com/errata/RHSA-2026:48818 REF https://access.redhat.com/errata/RHSA-2026:49775 REF https://access.redhat.com/errata/RHSA-2026:50223 REF https://access.redhat.com/errata/RHSA-2026:53371 REF https://access.redhat.com/errata/RHSA-2026:56786 REF https://access.redhat.com/errata/RHSA-2026:56853 REF https://access.redhat.com/errata/RHSA-2026:56911 REF https://access.redhat.com/errata/RHSA-2026:57402 REF https://access.redhat.com/errata/RHSA-2026:57483 REF https://access.redhat.com/errata/RHSA-2026:58981 REF https://access.redhat.com/errata/RHSA-2026:59831 REF https://access.redhat.com/errata/RHSA-2026:60019 REF https://access.redhat.com/errata/RHSA-2026:65839 REF https://access.redhat.com/errata/RHSA-2026:72394 REF https://access.redhat.com/errata/RHSA-2026:72395 REF https://access.redhat.com/errata/RHSA-2026:72399 REF https://access.redhat.com/errata/RHSA-2026:72470 REF https://access.redhat.com/errata/RHSA-2026:72475 REF https://access.redhat.com/errata/RHSA-2026:72476 REF https://access.redhat.com/errata/RHSA-2026:72502 REF https://access.redhat.com/errata/RHSA-2026:73909 REF https://access.redhat.com/errata/RHSA-2026:73959 REF https://access.redhat.com/errata/RHSA-2026:73960 REF https://access.redhat.com/errata/RHSA-2026:73961 REF https://access.redhat.com/errata/RHSA-2026:73962 REF https://access.redhat.com/errata/RHSA-2026:74458 REF https://access.redhat.com/errata/RHSA-2026:74459 REF https://access.redhat.com/errata/RHSA-2026:74460 REF https://access.redhat.com/errata/RHSA-2026:74461 REF https://access.redhat.com/errata/RHSA-2026:74462 REF https://access.redhat.com/errata/RHSA-2026:74463 REF https://access.redhat.com/errata/RHSA-2026:74674 REF https://access.redhat.com/errata/RHSA-2026:82304 REF https://access.redhat.com/errata/RHSA-2026:82322 REF https://access.redhat.com/errata/RHSA-2026:82336 REF https://access.redhat.com/errata/RHSA-2026:82347 REF https://access.redhat.com/errata/RHSA-2026:82354 REF https://access.redhat.com/errata/RHSA-2026:82372 REF https://access.redhat.com/errata/RHSA-2026:82857 REF https://access.redhat.com/errata/RHSA-2026:82888 REF https://access.redhat.com/security/cve/CVE-2026-48864 REF https://bugzilla.redhat.com/show_bug.cgi?id=2460425

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy