libmodulemd EUVD-2026-107038

Exploitation requires that libmodulemd process attacker-controlled module stream v2 (modulemd v2) metadata and serialize it to YAML through the rpm-map emission path, and that the crafted metadata declare MULTIPLE digest algorithm types so the vulnerable inner loop uses the digest-algorithm count as its bound instead of the per-table checksum count. Limiting factors: the attack vector is LOCAL (AV:L) - an attacker must get the malicious metadata into a context where a local tool/library serializes it - and impact is confined to a crash/denial of service with no privilege gain, no code execution, and no confirmed data exposure. Default single-digest-type metadata does not trigger the out-of-bounds read.

This is a genuinely moderate-to-low priority issue despite the 6.2 (Medium) CVSS score, and the signals are largely consistent. The Red Hat CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes a local-vector, availability-only impact: no confidentiality or integrity loss, only a crash/denial of service. No EPSS score was provided in the input, the CVE is NOT on the CISA KEV list, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis. The combination of local attack vector, DoS-only impact (an unprivileged crash of a YAML-serialization routine), and absence of exploitation evidence means this is a reliability/robustness bug more than a security emergency. CONFLICTING SIGNAL: the input Tags include 'Information Disclosure' and 'Buffer Overflow', but the vendor's own CVSS vector sets C:N/I:N and the description characterizes the defect as an out-of-bounds READ (CWE-125) that 'typically' causes a crash - i.e., denial of service, not confirmed data disclosure. Treat any information-disclosure framing as unverified; the authoritative impact per Red Hat is availability only.

An attacker supplies crafted modulemd stream v2 metadata (e.g., in a module repository or package metadata) that declares multiple digest algorithm types. When a tool using libmodulemd serializes this metadata to YAML via the rpm-map emission path, an inner loop reads past the end of the current digest checksum table, causing an out-of-bounds read that crashes the process. No public exploit code is identified at time of analysis, and exploitation requires the victim to process the attacker-controlled metadata locally.