RPM Package Manager CVE-2026-95520

Requires an attacker-crafted, untrusted RPM package in which a symlink entry declares RPMTAG_LONGFILESIZES = 0xFFFFFFFFFFFFFFFF and the cpio payload's filesize field carries the attacker-controlled overflow data. Exploitation is triggered when a victim parses that package with one of the specific tools rpm2cpio, rpm2archive, or 'rpm -qlvp' - none of which install or signature-verify the package, so signing is not a mitigation. Limiting factors: the attack vector is local (AV:L) and depends on user interaction (UI:R) to inspect the malicious file; it does not affect installed/signed packages processed through normal verified channels and there is no remote/network trigger.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H, base 7.1) frames this as a local, low-complexity, unauthenticated-but-user-interaction-dependent heap out-of-bounds write (CWE-787) with high integrity and availability impact and no confidentiality impact. The 'local' vector plus UI:R is accurate: exploitation requires a victim to process an attacker-supplied RPM with rpm2cpio, rpm2archive, or 'rpm -qlvp' - no network-facing service is involved. Crucially, all three trigger paths parse the package WITHOUT installing or verifying signatures, so the usual RPM signing defense does not apply. There is no public exploit identified at time of analysis and no EPSS or CISA KEV data in the provided input, so this is not confirmed as actively exploited; the I:H/A:H reflects a controlled heap overflow with realistic memory-corruption/potential-code-execution consequences, but Red Hat scored C:N so it is not rated as an information-disclosure primitive. This is a genuine, well-characterized memory-safety bug in a ubiquitous component, but the local vector and required user interaction keep it below the priority of a remotely triggerable flaw - treat as a solid patch-soon item rather than an emergency, absent evidence of in-the-wild use.

An attacker publishes or emails a malicious RPM whose RPMTAG_LONGFILESIZES field is set to 0xFFFFFFFFFFFFFFFF for a symlink entry; a user or automated pipeline inspects the untrusted package with 'rpm -qlvp', rpm2cpio, or rpm2archive. The integer overflow in iterReadArchiveNext() shrinks the buffer to one byte and the cpio filesize field then writes attacker-controlled bytes past the allocation, corrupting the heap. No public exploit code is identified at time of analysis, and no signature/install step is needed since these tools merely parse the package.