RPM Package Manager EUVD-2026-89790

Exploitation requires a victim to process an attacker-supplied, crafted unsigned RPM package using rpm tooling - specifically rpm2cpio, rpm2archive, or 'rpm -qlvp' - where RPMTAG_FILESIGNATURES is declared with the wrong header type to trigger the undersized hex2binv() allocation. Limiting factors: the attack is local (AV:L) and needs user interaction (UI:R) to run rpm against the malicious file; it does not require authentication or special privileges (PR:N). No non-default configuration is needed - merely inspecting an untrusted package is sufficient - which makes CI/build systems, package mirrors, and malware-analysis workflows the realistic exposure surface. Signature verification does not protect against this, since the overflow is triggered during header parsing of the unsigned package before/independent of validation.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H, 7.1) frames this as a local, low-complexity, unauthenticated flaw that still requires user interaction - specifically, a user must invoke an rpm operation against an attacker-supplied package. The vector is internally consistent with the description: the 'attack' is delivered as a malicious file, and the payoff is memory corruption (I:H/A:H) with no confidentiality impact (C:N). No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so there is no evidence of active exploitation; risk is driven by the ubiquity of rpm and the very common practice of inspecting untrusted packages with rpm2cpio, rpm2archive, or 'rpm -qlvp' (all explicitly named as reachable paths). The single realistic gating factor is UI:R - a victim must process the crafted package - which keeps this out of the worm/mass-exploitation tier despite affecting a core RHEL component across RHEL 6 through 10. Net: a genuine, patch-worthy priority for build/CI pipelines and analysts who examine untrusted RPMs, but not an emergency in the absence of KEV/EPSS/POC signals. One caveat: I:H for a heap overflow assumes memory corruption can be steered toward code execution; the description confirms an attacker-controlled out-of-bounds write but does not demonstrate reliable RCE, so treat the integrity impact as plausible rather than proven.

An attacker crafts an unsigned RPM in which RPMTAG_FILESIGNATURES is declared with an incorrect header type, so hex2binv() allocates a one-byte buffer and then writes attacker-chosen hex-decoded data past it. A developer, mirror operator, or malware analyst inspects the untrusted package with 'rpm -qlvp', rpm2cpio, or rpm2archive, triggering a heap-based buffer overflow that can crash the tool or corrupt heap memory for potential code execution. No public exploit code is identified at this time, and local access plus user interaction (running rpm against the file) are required.