libzypp EUVD-2026-41406

Exploitation requires the attacker to control the content of a repository's repomd.xml metadata (a hosted malicious repo, a compromised mirror, or a MITM position on repository traffic) AND the victim system must add or refresh that repository via libzypp/zypper - this is the UI:R user-interaction requirement. Specifically, the malicious 'keyhint' (gpg-pubkey) field in repomd.xml must contain a path/traversal sequence, which pre-17.38.12 libzypp accepts because its validation regex does not exclude '/'. Limiting factors: it cannot be sprayed at arbitrary hosts (SSVC Automatable: no) because the target must consume the attacker's repository; environments that only use trusted, GPG-signed, TLS-pinned repositories are largely protected; and it is specific to systems using libzypp (SUSE/openSUSE). No target-side authentication or attacker privileges on the host are needed (PR:N), and the file write occurs with libzypp's root privileges.

Signals are broadly consistent and point to a serious but not trivially remote-mass-exploitable issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:H, base 8.8) reflects a network-reachable, low-complexity flaw requiring no attacker privileges but requiring user interaction - the victim must add or refresh the attacker's repository. SSVC agrees on impact (Technical Impact: total) and notes Automatable: no, which matches the UI:R requirement: an attacker cannot spray this at arbitrary hosts, they must lure or already control a repository the target uses. EPSS is low (0.49%), and the issue is not in CISA KEV, so there is no evidence of widespread active exploitation despite public PoC. The practical priority is high for any environment that consumes third-party or mirror repositories (or where TLS/pinning is weak enough to allow repo MITM), and lower where all repositories are trusted and integrity-protected. Note the CVSS lists C:H, but the described primary impact is file injection/overwrite (Integrity/Availability); confidentiality is best understood as a consequence of gaining root code execution rather than a direct data-read primitive - worth verifying against the vendor advisory.

An attacker stands up (or MITM-substitutes) a software repository whose repomd.xml contains a gpg-pubkey keyhint value embedding a relative path traversal sequence. When an administrator or automated tooling adds or refreshes that repository, vulnerable libzypp resolves the attacker-controlled keyhint as a filesystem path and writes/overwrites a file as root - for example dropping a cron job, sudoers fragment, or SSH key - yielding root code execution. Public PoC exists, and the low attack complexity means a lured or compromised repository reliably triggers the flaw.