libsolv CVE-2026-9149

The victim must process a specially crafted .solv file in which the maxsize or allsize fields in the solv file header contain negative integer values, triggering the vulnerable allocation path in repo_add_solv() within src/repo_solv.c. This condition is met whenever a user or automated process (such as a package manager metadata refresh) ingests .solv repository data from an attacker-controlled or compromised source. The CVSS UI:R designation confirms that exploitation requires the victim system to actively or passively initiate the .solv parse - exploitation cannot succeed without this trigger. Exploitation is strictly bounded to denial of service (process crash); the CVSS vector (C:N/I:N/A:H) excludes code execution or information disclosure. No authentication is required of the attacker (PR:N), but the attacker must control or compromise a .solv-serving endpoint that the victim system will contact. Systems configured to consume only trusted, GPG-signed repository metadata are materially harder to exploit, as the attacker must first compromise a trusted source or intercept the metadata fetch.

CVSS 6.5 (Medium) reflects the combination of network reachability (AV:N), low attack complexity (AC:L), and no required attacker privileges (PR:N), partially offset by mandatory user interaction (UI:R), unchanged scope (S:U), and an impact profile limited entirely to availability (C:N/I:N/A:H). The UI:R constraint is practically significant: exploitation cannot be fully automated without the victim system actively processing a malicious .solv file. However, because libsolv is invoked programmatically by package managers during routine repository metadata refreshes, a victim may trigger the flaw without explicit awareness - reducing the practical barrier below what UI:R typically implies in browser or document contexts. No EPSS score was available in the provided data, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, confirming no known active exploitation at time of analysis. The impact ceiling is denial of service only; neither code execution nor data exposure is supported by the CVSS vector or description. Real-world priority is moderate-to-elevated for systems that ingest .solv metadata from third-party, untrusted, or user-supplied repository sources (e.g., CI/CD pipelines, package mirrors, developer workstations adding community repos), and lower for tightly controlled production environments that enforce signed, trusted repository sources exclusively.

An attacker crafts a .solv repository metadata file with negative values embedded in the maxsize or allsize header fields, then hosts it on a rogue or compromised package repository endpoint. When a victim's package manager (such as dnf or zypper) performs a routine repository metadata refresh against the attacker-controlled source - or when a user manually adds the repository - repo_add_solv() processes the malicious file, allocates an undersized heap buffer, writes beyond its bounds, and crashes the process, resulting in a denial of service. No public exploit identified at time of analysis, though the PR #617 fix diff precisely identifies the vulnerable code location, materially reducing the effort required to develop a proof-of-concept.