libsolv CVE-2026-82327

Exploitation requires that a .solv repository cache file with an out-of-range directory-id in its compressed filelist section exists on the local filesystem in a path processed by dnf, yum, or zypper. This condition can arise either from an unclean system shutdown (natural corruption) or from deliberate planting by an attacker with local write access to the cache directory. A user must then actively invoke a package management tool that triggers libsolv's cache-rewrite code path (UI:R per CVSS). The CVSS AV:L metric confirms no remote network path to exploitation; access to the local filesystem is a hard prerequisite. The fixed, non-attacker-controlled nature of the out-of-bounds write value limits exploitation exclusively to denial of service - crashing the package manager process. Standard RHEL deployments restrict /var/cache/dnf to root, meaning an unprivileged local attacker would first need privilege escalation to write a crafted file there.

The vendor-assigned CVSS 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) reflects a moderate, local denial-of-service vulnerability. The local attack vector and required user interaction both constrain real-world exploitability: an attacker cannot trigger this remotely without first achieving local filesystem access, and the crash occurs only when a user actively invokes a package manager command. The description's explicit statement that the overwritten value is fixed and non-attacker-controlled provides high confidence that this cannot be escalated to code execution under normal exploitation models, making the 'RCE' metadata tag a likely classification error rather than a confirmed capability. No EPSS score was provided and the CVE is absent from CISA KEV, consistent with no known active exploitation. Real-world risk is further bounded by the fact that package manager cache directories on RHEL systems are typically root-owned and not writable by unprivileged users, raising the practical bar for intentional exploitation. A higher-priority scenario is unintentional triggering by a legitimately torn .solv file after an unclean shutdown, which could disrupt automated patching workflows on production servers.

A local user with write access to a dnf repository cache directory places a malformed .solv file containing an out-of-range directory-id value in the compressed filelist section. When a user (or automated cron job) subsequently runs 'dnf check-update' or 'dnf upgrade', libsolv processes the cache file, writes a fixed value to an out-of-bounds memory address, and the dnf process crashes - disrupting the update operation. A non-adversarial but equally realistic trigger is an unclean system shutdown that tears a .solv file mid-write, causing the same crash the next time any package manager command is run.