Skip to main content

Severity by source

Vendor (redhat) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SUSE
HIGH
qualitative
Red Hat
7.8 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jun 08, 2026 - 10:23 vuln.today
CVE Published
May 26, 2026 - 16:16 nvd
HIGH 7.8

DescriptionCVE.org

A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within .solv files due to insufficient input validation. An attacker can provide a specially crafted .solv file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or a denial of service.

AnalysisAI

Heap buffer overflow in libsolv allows local attackers to corrupt memory when a vulnerable application processes a maliciously crafted .solv repository metadata file. The flaw stems from insufficient input validation during decompression of attacker-controlled data, enabling information disclosure, control-flow alteration, or denial of service across multiple Red Hat Enterprise Linux releases and SUSE distributions. SSVC marks exploitation as PoC-level with total technical impact, while EPSS remains very low at 0.01%, indicating limited probability of widespread exploitation despite high severity.

Technical ContextAI

libsolv is a widely used dependency-solver library originally developed by SUSE and adopted across RPM-based ecosystems (Red Hat, Fedora, openSUSE) for package metadata handling. The .solv file format is a compressed binary representation of repository metadata consumed by package managers such as DNF, Zypper, and tooling embedded in OpenShift, Satellite, and Red Hat Update Infrastructure. The root cause maps to CWE-787 (Out-of-bounds Write): the decompression routine trusts size or offset fields from the input stream without sufficient bounds checking, allowing a crafted compressed blob to overflow a heap buffer during parsing. Affected CPEs span Red Hat Enterprise Linux 7, 8, 9, and 10, Red Hat Hardened Images, OpenShift Container Platform 4, Satellite 6, and Red Hat Update Infrastructure 4, reflecting libsolv's pervasive role in package and image management pipelines.

RemediationAI

Apply the vendor-released patch by updating libsolv to the fixed package version delivered in RHSA-2026:21333 (https://access.redhat.com/errata/RHSA-2026:21333) and the corresponding SUSE security updates for openSUSE/SLES streams; rebuild or repull affected container images (OpenShift, Hardened Images) so the patched libsolv propagates into running workloads. Where immediate patching is not possible, restrict the systems that consume .solv data to trusted, signed repositories only and avoid running package operations against untrusted repository metadata, accepting the trade-off that internal or third-party mirrors may need re-verification. On Satellite and Red Hat Update Infrastructure hosts, treat repository sync sources as a sensitive trust boundary and audit any custom upstreams; in container build pipelines, avoid mounting or processing externally supplied .solv caches until libsolv is updated. Additional advisory context is available at https://access.redhat.com/security/cve/CVE-2026-48864 and https://bugzilla.redhat.com/show_bug.cgi?id=2460425.

CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h

CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft

CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls

CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege

CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator

CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

CVE-2026-11610 HIGH
8.8 Jul 07

Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD

CVE-2026-14474 HIGH
8.8 Jul 07

Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user

CVE-2026-52720 HIGH
8.8 Jun 15

Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co

CVE-2026-59851 HIGH
8.8 Jul 21

Privilege escalation via authentication bypass in libssh affects servers that enable GSSAPIKeyExchange, where the gssapi

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.4 Fixed
SUSE Linux Enterprise Micro 5.5 Fixed

Share

EUVD-2026-31859 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy