libsolv EUVD-2026-31202

Exploitation requires three concurrent conditions: (1) the target system uses a version of libsolv that exercises the Debian metadata parsing code path (ext/repo_deb.c), (2) the Debian repository metadata being parsed contains SHA384 or SHA512 checksum tags - SHA256 checksums fit within the original buffer and do not trigger the overflow, and (3) a user or automated process actively initiates a package management operation (e.g., repository refresh, package search, dependency resolution) that fetches metadata from the attacker-controlled repository. The CVSS UI:R flag confirms that passive or background exploitation without user-initiated action is not indicated. Authentication is not required per PR:N in the CVSS vector. Exploitation is limited by the requirement that the target must be directed to a malicious repository; systems restricted to trusted, internal package mirrors with no access to external Debian repositories are not exposed.

The CVSS 6.5 score (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) reflects a network-reachable attack requiring no authentication and low complexity, but constrained by a mandatory user interaction step - exploitation is not passive and requires a user or automated process to initiate a package operation against the malicious repository. The impact is scoped strictly to availability (DoS); confidentiality and integrity are unaffected per the vector. No EPSS score was provided, preventing quantitative exploitation-probability assessment. The absence from CISA KEV and the lack of any public exploit code are consistent signals that this is not being actively exploited at scale. While stack overflows of this class can theoretically lead to code execution depending on stack layout and OS mitigations (ASLR, stack canaries), the CVE description and CVSS confirm only DoS as the demonstrated impact. The user interaction requirement (UI:R) materially limits opportunistic exploitation; risk is most relevant to automated build pipelines or CI/CD systems that pull from third-party Debian repositories without verification.

An attacker configures a malicious Debian repository and populates its package index with entries containing SHA384 or SHA512 checksum fields. When a developer or automated CI pipeline running an affected libsolv version initiates a repository sync or package query against this repository, libsolv's Debian metadata parser copies the oversized checksum string into the 65-byte stack buffer, overflowing it and corrupting adjacent stack memory, resulting in a process crash and denial of service. No public exploit code has been identified at time of analysis.