A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling… (CVE-2026-48863)

CVE-2026-48863 describes a stack-based buffer overflow in libsolv's PGP verification component caused by improper length handling when copying the EdDSA 's' MPI value into a stack buffer. This flaw allows a remote attacker to create a malicious Ed25519 PGP signature with mismatched MPI lengths. When libsolv processes this crafted signature, it may trigger a denial of service by crashing or destabilizing the application handling package or repository verification workflows.

The vulnerability can lead to denial of service (DoS) conditions in systems using libsolv for automated package or repository processing when they encounter maliciously crafted Ed25519 PGP signatures. There is no indication of confidentiality or integrity impact, nor evidence of remote code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting or validating PGP signatures from untrusted sources to reduce exposure to malformed signatures.