A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository… (CVE-2026-82327)

CVE-2026-82327 is a flaw in libsolv where directory-id values read from compressed filelist data in .solv cache files are not validated for expected range. When libsolv rewrites such a cache file, a corrupted or specially crafted file (e.g., left in a torn state after an unclean shutdown) can trigger an out-of-bounds memory write during subsequent processing by tools like dnf, yum, or zypper. This causes a crash (denial of service) but does not allow arbitrary code execution due to the fixed value written out-of-bounds.

Successful exploitation leads to denial of service by crashing affected package management tools (dnf, yum, zypper). There is no impact on confidentiality or integrity, and arbitrary code execution is not expected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using package management tools on systems with potentially corrupted .solv cache files or ensure clean system shutdowns to prevent cache corruption.