libmodulemd EUVD-2026-107037

Exploitation requires the attacker to supply crafted modulemd YAML whose xmd field contains deeply nested mapping/sequence content, and to get that YAML into a code path where libmodulemd parses it (e.g., a malicious or attacker-controlled module repository or metadata file consumed by DNF/libdnf or another libmodulemd consumer). The attack vector is local (AV:L), so this is not remotely triggerable without first delivering the malicious metadata to the host; no authentication is required per PR:N, and no user interaction is required (UI:N). The primary limiting factors are the need for local processing of attacker-influenced module metadata and the impact being confined to availability (process crash / resource exhaustion), with no confidentiality or integrity effect.

This is a medium-severity, availability-only denial-of-service issue, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 6.2) correctly reflects the root cause described: uncontrolled recursion (CWE-674) when libmodulemd converts the xmd field into nested GVariant values with no recursion-depth or node-count limit, causing stack exhaustion. The AV:L (local) vector is the key limiter - an attacker cannot trigger this directly over the network; they must get crafted modulemd YAML into a code path that parses it on the target host. There is no confidentiality or integrity impact (C:N/I:N), only availability (A:H). No EPSS score, CISA KEV listing, or public POC is present in the provided data, so exploitation probability signals are absent - there is no public exploit identified at time of analysis. This is a real but lower-priority hardening fix: easy to trigger once malicious metadata reaches the parser, but constrained by the local attack surface and bounded to crashing the parsing process rather than code execution. Note that A:H here reflects impact on the affected process/service, not necessarily a full-host outage; patch and fixed-version data are not provided in the input and should be confirmed against the Red Hat advisory.

An attacker crafts modulemd YAML containing a deeply nested xmd structure and gets it onto a system where libmodulemd will parse it - for example via a malicious or compromised module repository, or a supplied metadata file processed by a DNF/libdnf-based tool. When the library recursively converts the nested mapping/sequence into GVariant values with no depth limit, the stack is exhausted and the parsing process crashes or consumes excessive resources, denying service. No public POC is referenced in the available data.